see link

Original writeup (https://rawsec.ml/en/TPCTF-2017-write-ups/#60-what-is-this-place-web).