This exercise covers how the PHP phar:// handler can be used to gain code execution using PHP unserialize.
/usr/local/bin/score ....