Overwrite `fini_array` to `win` address

Original writeup (https://hong5489.github.io/2022-05-01-nahamconctf2022/#detour).