Rating:

1. Flip `exit@got` to jump back to `entry`
2. Enable debug functionality of flipping function and leak libc addres
3. Leak `environ` in libc to get stack address
4. Modify stack data to jump to `system`

Original writeup (https://blog.justins.in/redpwnctf-2020#pwn-kevin-higgs).