Original writeup (https://github.com/qqgnoe466263/My-PWN-Life/blob/master/tutorial/BalsnCTF2020/diary/exploit.py).