I'm not a low-level security hacker but I've created and debugged enough C code in my career to follow exactly what is going on here.

I don't know if I would have been able to derive this solution on my own though, that's where the creativity comes in. However, I'm guessing these CTF challenges are usually kind of "similar" in the same way that ACM programming challenges are. If you do these sort or challenges often enough it should become easier.

The CTFs I've played usually had a good mix of web stuff and binary exploitation.

Also, the best way to learn this stuff is to do it. Even if this seems out of your league, I'd suggest to just join a team and start playing - if that kind of thing seems interesting to you.

Try microcorruption.com--it's pretty accessible to anyone who understands basic C programming concepts (like stacks and null-terminated strings) and the challenges have a nice progression in difficulty and complexity.

Well, if there are people analyzing exploits then there must also be people creating them... :->