In short:

• overflow in gets
• overwrite ptr to GOT table, patch free and overwrite atoi to puts to leak
• ret2libc

Original writeup (https://github.com/noAuxy/writeups/blob/master/2019/2019-04-28-StarCTF.md#quicksort).