In short:

• Use pop to control a read syscall
• Use read to write a new shellcode

Original writeup (https://github.com/noAuxy/writeups/blob/master/2019/2019-04-28-StarCTF.md#babyshell).