Original writeup (https://github.com/Neolex-Security/Writeups/blob/master/TAMUCTF%202019/Pwn/pwn2.md).