• overwrite index of buffer
• overwrite return address with execve("/bin/sh",0,0)

more details

Original writeup (http://taqini.space/2020/04/27/ijctf2020-wp/#Input-Checker-100pt).