We know the challenge is about backup files, and usaally, there is backup files like filename + ~. So, let’s try and get index.php~ (if exist)

I tried, and got a file that i downloaded which is called index.php_, there i could saw the source code, plus these lines:

$username="ch11";
$password="OCCY9AcNm1tj";

Flag: OCCY9AcNm1tj