Hint for Waldo

Anyone got any ideas? Been playing with RESTClient to try read directories or files using fd.php and dd.php but its returning false on whatever I throw at it. Any ideas? The background image requires a passphrase to extract st**** data from it.