" OK, by chaining above techniques(session upload progress + race condition + PHP wrappers), we can get the shell back!"