1. buffer overflow to format string bug is easy
2. Now we're able to trigger format string bug once using 27 bytes charecters at most.
3. It's obvious that if we hijack exit@got to superSecretFunc, we will get flag.

So the task can be completed with the following steps:

• bof to fsb

- hijack exit@got to superSecretFunc and fix retaddr to call exit.

• hijack exit@got to superSecretFunc and the bianry will call exit(0) at the end of main.
• the length of payload is less than 27-byte.

Here is my exp

Original writeup (https://github.com/0x01f/pwn_repo/blob/master/noxCTF2018_The_Name_Calculator/exp.py).