Writeup solving "PHP Master" and "Santa's consolation" from X-MAS CTF 2020

Using a specially crafted cookie, you can write data to /dev/null. Can you abuse the write and read the flag?

Can you identify a way to bypass our login logic? MD5 is supposed to be a one-way function right?