Buffer overflow, call oneshot gadget. Check the writeup for more details.

Original writeup (https://github.com/guyinatuxedo/nightmare/tree/master/modules/8-bof_dynamic/csaw19_babyboi).