Bouncer — DalCTF 2026
A read-only anonymous FTP gateway turns out to be a Redis health-check proxy; abusing the PORT command for an FTP bounce plus a newline-smuggled RETR inline command yields a bidirectional Redis relay that scans the subnet and reads the flag.