### Summary
1. calloc(-1, …) is return 0
2. puts_got → main
3. exit_got → 0x400846
4. setbuf_got → puts_plt+6 (leak!)
5. alarm_got → main+1
6. puts_got → one_gadget

Original writeup (https://blog.jsec.xyz/ctf-write-up/2021/03/08/zer0pts-CTF-2021-Oneshot-write-up.html).