一步一步逆着走就可以了。
php > var_dump(str_rot13(a1zLbgQsCESEIqRLwuQAyMwLyq2L5VwBxqGA3RQAyumZ0tmMvSGM2ZwB4tws));
PHP Notice: Use of undefined constant a1zLbgQsCESEIqRLwuQAyMwLyq2L5VwBxqGA3RQAyumZ0tmMvSGM2ZwB4tws - assumed 'a1zLbgQsCESEIqRLwuQAyMwLyq2L5VwBxqGA3RQAyumZ0tmMvSGM2ZwB4tws' in php shell code on line 1
string(60) "n1mYotDfPRFRVdEYjhDNlZjYld2Y5IjOkdTN3EDNlhzM0gzZiFTZ2MjO4gjf"
php > var_dump(strrev(n1mYotDfPRFRVdEYjhDNlZjYld2Y5IjOkdTN3EDNlhzM0gzZiFTZ2MjO4gjf));
PHP Notice: Use of undefined constant n1mYotDfPRFRVdEYjhDNlZjYld2Y5IjOkdTN3EDNlhzM0gzZiFTZ2MjO4gjf - assumed 'n1mYotDfPRFRVdEYjhDNlZjYld2Y5IjOkdTN3EDNlhzM0gzZiFTZ2MjO4gjf' in php shell code on line 1
string(60) "fjg4OjM2ZTFiZzg0MzhlNDE3NTdkOjI5Y2dlYjZlNDhjYEdVRFRPfDtoYm1n"
php > var_dump(base64_decode(fjg4OjM2ZTFiZzg0MzhlNDE3NTdkOjI5Y2dlYjZlNDhjYEdVRFRPfDtoYm1n));
PHP Notice: Use of undefined constant fjg4OjM2ZTFiZzg0MzhlNDE3NTdkOjI5Y2dlYjZlNDhjYEdVRFRPfDtoYm1n - assumed 'fjg4OjM2ZTFiZzg0MzhlNDE3NTdkOjI5Y2dlYjZlNDhjYEdVRFRPfDtoYm1n' in php shell code on line 1
string(45) "~88:36e1bg8438e41757d:29cgeb6e48c`GUDTO|;hbmg"
//每个字符的ascii码减一，得到'}77925d0af7327d30646c918bfda5d37b_FTCSN{:galf'
php > var_dump(strrev('}77925d0af7327d30646c918bfda5d37b_FTCSN{:galf'));
string(45) "flag:{NSCTF_b73d5adfb819c64603d7237fa0d52977}"
php >