1. modify `canary` in TLS
2. overwrite GOT of `stack_chk_fail` with `main`
3. leak `puts`
4. overwrite GOT of `stack_chk_fail` with `one gadget`

[read more](http://note.taqini.space/#/ctf/ByteBanditsCTF-2020/?id=look-beyond)

Original writeup (http://taqini.space/2020/04/13/ByteBanditsCTF-Pwn-Writeup/#look-beyond).