TLDR;
- Bruteforce for `/cgi-bin/scriptlet`
- Shellshock

[Writeup](https://jsur.in/posts/2020-04-06-auctf-2020-writeups#m1-abrams)

Original writeup (https://jsur.in/posts/2020-04-06-auctf-2020-writeups#m1-abrams).