Rating: 4.0

1. BOF into `finallyyouhelpedme`
2. Use `helpishere` as a fake stack frame
3. Perform stack pivot to start reading from fake stack frame
4. Leak libc address
5. Execute one gadget

Original writeup (https://blog.justins.in/zh3r0-ctf-2020#help).