Challenge involved a PHP script authentication bypass in order to retrieve the flag.

Our writeup can be found here:

http://capturetheswag.blogspot.com/