diff --git a/src/index.php b/src/index.php
new file mode 100644
index 0000000..ac76c4c
--- /dev/null
+++ b/src/index.php
@@ -0,0 +1,47 @@
+<html>
+
+<body>
+
+    <head>
+        <meta charset="UTF-8">
+        <title>登录</title>
+    </head>
+    <p>这里�?管理员登录入�?</p>
+    <form method="POST" action="">
+        Username: <input type="text" name="username"> <br>
+        Password: <input type="password" name="password"> <br>
+        <button type="submit">Submit</button>
+    </form>
+    <!-- /source.txt -->
+</body>
+
+</html <?php
+
+
+$flag = "FLAGFLAGFLAG";
+$secret = "sGucne9iD0"; // 10 characters long
+
+if(!isset($_POST["username"]) || !isset($_POST["password"])){
+	exit();
+}
+$username = $_POST["username"];
+$password = $_POST["password"];
+ 
+if (!empty($_COOKIE["check"])) {
+
+
+    if (urldecode($username) === "admin" && urldecode($password) != "admin") {
+        if ($_COOKIE["check"] === md5($secret . urldecode($username . $password))) {
+            echo "Login successful.\n";
+            die ("The flag is ". $flag);
+        }
+        else {
+            die ("Wrong Cookies. Get out!");
+        }
+    }
+    else {
+        die ("Admins only");
+    }
+}
+ 
+setcookie("ahash", md5($secret . urldecode("admin" . "admin")), time() + (60 * 60 * 24 * 7));
\ No newline at end of file
diff --git a/src/source.txt b/src/source.txt
new file mode 100644
index 0000000..c63f35f
--- /dev/null
+++ b/src/source.txt
@@ -0,0 +1,28 @@
+<?php
+$secret = "XXXXXXXXXX";
+
+if(!isset($_POST["username"]) || !isset($_POST["password"])){
+    exit();
+}
+$username = $_POST["username"];
+$password = $_POST["password"];
+ 
+if (!empty($_COOKIE["check"])) {
+
+
+    if (urldecode($username) === "admin" && urldecode($password) != "admin") {
+        if ($_COOKIE["check"] === md5($secret . urldecode($username . $password))) {
+            echo "Login successful.\n";
+            die ("The flag is ". $flag);
+        }
+        else {
+            die ("Wrong Cookies. Get out!");
+        }
+    }
+    else {
+        die ("Admins only");
+    }
+}
+ 
+setcookie("ahash", md5($secret . urldecode("admin" . "admin")), time() + (60 * 60 * 24 * 7));
+?>
\ No newline at end of file
