If it's nginx + fpm + "empty" index.php, it's a meme and not exploitable.

edit: looks more like nginx + cli-server. But the 1MB nginx body limit is annoying. Why is nobody setting up these CTF servers with a setup people actually say would be easy to exploit. Like a LAMP stack.