use $_=([]."")[([]==[])+([]==[])+([]==[])] to get a lowercase a
use $_=([]."")[[].[]+[][[]]] to get an uppercase A
use [varname]++ to increase the ascii value for each of these to get all ascii letters
take a string and join our characters one by one with .=
for other characters, we can just join then with .="char", assuming it is allowed.
Our first goal is to get phpinfo, to see if there are any disabled functions:
Payload:
We can see that useful functions which would have allowed us to read from the file like file_get_contents are disabled. However, readfile() is not disabled, so we can use that. We can then use printf() to output that to us.
Our final payload will then eval to: printf(readfile("FLAG.PHP"))