Heap overflow then read the flag in memory.

Original writeup (https://www.pwntera.fr/write-up/2018/11/18/ritsec-pwn2.html).