Breaking Out of PHP disable_functions

You dropped a web shell, typed system('id') — and got nothing. The exec family is disabled, open_basedir walls off the disk. That is not the end of the engagement. It is the start of a more interesting one: reaching the kernel through every door PHP forgot to lock.