<?php 
  include "./config.php"; 
  login_chk(); 
  dbconnect(); 
  if(preg_match('/prob|_|\.|\(\)/i', $_GET[pw])) exit("No Hack ~_~"); 
  $query = "select id from prob_orc where id='admin' and pw='{$_GET[pw]}'"; 
  echo "<hr>query : <strong>{$query}</strong><hr><br>"; 
  $result = @mysql_fetch_array(mysql_query($query)); 
  if($result['id']) echo "<h2>Hello admin</h2>"; 
  $_GET[pw] = addslashes($_GET[pw]); 
  $query = "select pw from prob_orc where id='admin' and pw='{$_GET[pw]}'"; 
  $result = @mysql_fetch_array(mysql_query($query)); 
  if(($result['pw']) && ($result['pw'] == $_GET['pw'])) solve("orc"); 
  highlight_file(__FILE__); 
?>

pw='' || length(pw)>0
.
.
pw='' || ascii(substr(pw,1,1))>0
.
.

<?php
   error_reporting(0);
   require __DIR__.'/lib.php';

   if(isset($_GET['url'])){
       $url = $_GET['url'];

       if(!preg_match('/^https?\:\/\/'.$_SERVER['HTTP_HOST'].'/i', $url)){
           die('Not allowed URL');
       }

       if(preg_match('/_|\s|\0/', $url)){
           die('Not allowed character');
       }

       $parse = parse_url($url);
       if(basename($parse['path']) !== 'plz_give_me'){
           die('Not allowed path');
       }

       $ch = curl_init();
       curl_setopt($ch, CURLOPT_URL, $parse['scheme'].'://'.$parse['host'].'/'.$flag);
       curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
       curl_exec($ch);
       curl_close($ch);

       echo 'Okay<hr>';
   }

   highlight_file(__FILE__);

 <?php
/*******************************************************************
 * PHP Challenge 2015
 *******************************************************************
 * Why leave all the fun to the XSS crowd?
 *
 * Do you know PHP?
 * And are you up to date with all its latest peculiarities?
 *
 * Are you sure?
 *
 * If you believe you do then solve this challenge and create an
 * input that will make the following code believe you are the ADMIN.
 * Becoming any other user is not good enough, but a first step.
 *
 * Attention this code is installed on a Mac OS X 10.9 system
 * that is running PHP 5.4.30 !!!
 *
 * TIPS: OS X is mentioned because OS X never runs latest PHP
 *       Challenge will not work with latest PHP
 *       Also challenge will only work on 64bit systems
 *       To solve challenge you need to combine what a normal
 *       attacker would do when he sees this code with knowledge
 *       about latest known PHP quirks
 *       And you cannot bruteforce the admin password directly.
 *       To give you an idea - first half is:
 *          orewgfpeowöfgphewoöfeiuwgöpuerhjwfiuvuger
 *
 * If you know the answer please submit it to info@sektioneins.de
 ********************************************************************/

 <?php
        $auth = false;
        $role = "guest";
        $salt ="xxxxxxxxxxxxx";//len:13
        if (isset($_COOKIE["role"]))
        {
                $role = $_COOKIE["role"];
                $hsh = $_COOKIE["hsh"];
                if (stripos($role,"admin")!==false&&$hsh === md5($salt.$_COOKIE["role"]))
                {
                        $auth = true;
                }
                else
                {
                        $auth = false;
                }
        }
        else
        {
                $s = $role;
                setcookie('role',$s);
                $hsh = md5($salt.$s);
                setcookie('hsh',$hsh);
        }
        if ($auth) {
                echo "Welcome Admin.Your flag is cumtctf{you_know_this_is_not_the_flag}";
        } else {
                echo "<h3>Only Admin can see the flag!!";
        }
?>

<?php
 $x=$_GET["id"]; 
$x=str_replace("a","aad",$x); 
$x=str_replace("i","in",$x); 
$x1=substr($x,1,2); 
$x2=substr($x,3,6); 
 $x3=$x1.$x2; 
if ($x3=="admin") 
  echo "ok";
 ?>