# CONFidence CTF Teaser 2019 – My admin panel
* **Category:** web, warmup* **Points:** 51
## Challenge
> I think I've found something interesting, but I'm not really a PHP expert. Do you think it's exploitable?>> https://gameserver.zajebistyc.tf/admin/
## Solution
The website has directory listing active, connecting to it two files are listed:* `login.php`* `login.php.bak`
The first page prints the message: `Not authenticated.`.
The [second file](https://raw.githubusercontent.com/m3ssap0/CTF-Writeups/master/CONFidence%20CTF%20Teaser%202019/My%20admin%20panel/login.php.bak) contains the PHP source code.
```php {}".format(err.code)      break
```
With the cookie `otadmin={"hash": 389}` you will discover the flag.
```p4{wtf_php_comparisons_how_do_they_work}```