An easy but very unique challenge.

You are allowed to sum 5 numbers together. There is an off by one error when inputting the 5 numbers, which lets you actually input 6 numbers.

The 6th number overwrites the pointer to the `total` variable, which lets you write the sum total of the 6 numbers as a value to whatever memory location you want.

Steps to exploitation:
1. Overwrite `exit_got` to a `pop rdi; ret` gadget
2. ROP chain to leak a libc address using `puts`
3. ROP chain to call `system('/bin/sh')`

Detailed writeup at the link