A Discuz! X5.0 writeup chains shared crypto keys, database export and import timing, and an admin plugin LFI into a claimed pre-auth RCE path. The strongest lesson is not the CAPTCHA model or the shell screenshot, but the way a late validation step and a reused authcode primitive let unrelated features start trusting each other.