[Challenge Name] — [CTF Name]

Provide a brief summary of the challenge. What is the objective? What category does it fall under? Include the challenge description as given by the CTF organizers.

Challenge: [Challenge Name]
Points:    [XXX]
Category:  [Web / Pwn / Rev / Crypto / Forensics / Misc]
Solves:    [XX] teams

Description:
"[Paste the original challenge description here]"

Files provided: [list any files, binaries, or URLs given]

Document your initial analysis. What did you observe first? What tools did you use for enumeration? Include scans, directory listings, source code review, etc.

# Example: Web challenge recon
$ curl -s http://target.ctf/ | head -20
$ gobuster dir -u http://target.ctf -w /usr/share/wordlists/common.txt
$ nmap -sV -sC target.ctf

# Example: Binary challenge recon
$ file challenge_binary
$ checksec --file=challenge_binary
$ strings challenge_binary | grep -i flag

What vulnerability did you identify? Explain the bug class (e.g., SQL injection, buffer overflow, insecure deserialization). Include relevant code snippets if source was available.

// Example: Identified SQL injection in login endpoint
// POST /api/login
// Body: { "username": "admin' OR 1=1--", "password": "x" }

// Example: Buffer overflow in binary
// Input buffer is 64 bytes but read() accepts 256
// Offset to RIP: 72 bytes

• Identify the vulnerability class (CWE if possible)
• Explain WHY the vulnerability exists
• Show the proof that the vulnerability is exploitable
• Note any protections you need to bypass (ASLR, canaries, WAF, etc.)

Walk through the exploit step by step. Include your exploit script/payload and explain each part. This is the core of the writeup.

#!/usr/bin/env python3
"""
Exploit for [Challenge Name] - [CTF Name]
Author: [Your Handle]
"""

from pwn import *  # or requests, etc.

# === Configuration ===
TARGET = "[target address]"
PORT   = [port]

# === Step 1: [Describe what this does] ===
# [Your exploit code here]

# === Step 2: [Describe what this does] ===
# [Your exploit code here]

# === Step 3: Capture the flag ===
# [Your exploit code here]

print(f"[+] Flag: {flag}")

Show the successful flag capture. Include terminal output, screenshots, or proof of completion. If there were post-exploitation steps, document them.

$ python3 exploit.py
[+] Connected to target
[+] Payload delivered
[+] Flag: flag{PLACEHOLDER_REPLACE_WITH_ACTUAL_FLAG}

# Or for web challenges:
# Successfully accessed /admin/flag.txt
# flag{PLACEHOLDER_REPLACE_WITH_ACTUAL_FLAG}

• What new technique or concept did you learn?
• What would you do differently next time?
• What similar challenges should you practice?
• How does this vulnerability apply to real-world scenarios?
• Any alternative solutions other teams used?

• [Link to CTF event page]
• [Link to relevant CVE or vulnerability documentation]
• [Link to similar writeups for comparison]
• [Link to tool documentation used]