Fun Challenge!
Even though I knew some bits about the script language, It took me ages even to get some output back. Having done that, I had learned enough to pop the flag in seconds.
The vulnerability and exploit path are a piece of cake to figure out. Creating the right payload took me some time. The very commonly presented ***[40] payload didn’t work for me, so I gave in and learned how it actually works under the hood. Took lots of testing and searching the right gadgets to develop my own payload, but the learning experience was worth it.
Also, seeing your very own manufactured from scratch, grass-fed artisan organic payload work as intended is always priceless.
Highly recommended for beginners.