This "protected" form runs its captcha check in JavaScript only. The server accepts any POST. Bypass the client validation (or just POST directly with curl).
Direct: curl -X POST -d data=x http://TARGET/captcha
CWAP Prep Labs · HackXpert Coaching · The XSS Rat · authorized lab use only