Rating:

In this challenge we abused uninitialized buffers on the stack to leak the flag by carefully calling functions from the main menu.

Original writeup (https://blog.oppida.apave.com/en/Nos-articles/BuckeyeCTF-2021-Staff).