Tags: speedrun pwn 

Rating: 0

Buffer overflow into ROP Chain,
call puts for leak puts and read address, use oneshot gadet.

[Full exploit](https://github.com/wotmd/CTF_Exploit/tree/master/DEFCON_CTF_2019/speedrun002)