You have php shell on subdomain1.example.com Is it possible to retrieve files from subdomain2.example.com? Yes Possible in some cases and doing this is called real php shell escalation
You must reply before you can see the hidden data contained here.