LFI Reading with basic Base64 wrappers

Brasswick Clockworks has been handcrafting clocks for a century; last year, they moved their workshop and employee portal online without giving it much thought. The parameter used to load the pages only allows for reading its own source code via a PHP wrapper—but that’s enough to start pulling at the thread: plaintext database credentials, direct access to MySQL, a weak hash that can be cracked offline, and, finally, the admin panel containing the flag. It’s a single flag with no privilege escalation required—perfect for practicing restricted LFI, source code disclosure, credential reuse, and hash cracking, all in one sequence.