Unlucky for me because i didn't manage to solve this during the competition, what a waste of 200 point :( 
anyway, here are some poc, thanks to aspan for pointing me that the checking is at pg_receive.php




some poc script

some poc video
here