Original writeup (https://jh00nsec.wordpress.com/2016/03/28/pwn2win-ctf-2016-v0t3-65-points-web-hacking-rtfm-team/).