Original writeup (https://neg9.org/news/2015/10/13/def-con-ctf-quals-2015-access-control-reverse-engineering-1-writeup).