This is based on https://hugeh0ge.github.io/2019/11/04/Getting-Arbitrary-Code-Execution-from-fopen-s-2nd-Argument/
Credits: @hugeh0ge
It uses iconv, in php, in order to execute the same payload.
Uses cases :
- You control the first parameter of 
iconv(in_charset), you can set an env var and you can upload arbitrary files (.solibrary file and thegconv-modulesfile) and you know their path. - You have a php RCE but 
system,shell_exec,curl_execand other functions are disabled but you cansetenv(andLD_PRELOADis blacklisted).