Exploiting a cvar help

Hi, I found a server that had sv_allowdownload and sv_allow.upload set to 1. (I know there is a period there)
How can I download a cfg file from the server, for example server.cfg to get the RCON password if they have it there?
Thanks.

http://www.mpgh.net/forum/showthread.php?t=796159
This sadly doesn't work to find the RCON_PASSWORD but it's pretty hard to do that without a backdoor.
This is a .dll it can spoof those CVARs even if they are set to 0. It can also spoof sv_allowcslua and sv_cheats and host_timescale.

ty luahax i spoofed rcon_password, now i can hack on every server