1. Create player1, set 0x21 for all fields
2. Add, Select, Remove player2 to get dangling pointer
3. Edit player2 via dangling pointer to point at player1 data
4. Write the address of strlen() in GOT to player2 name (overwriting player1 name pointer)
5. Edit player1 name, dereferencing GOT pointer and overwriting GOT address
6. Point strlen to gadget to shift stack
7. ROP to clear a couple of registers before hitting /bin/sh one gadget

Original writeup (https://flawed.net.nz/2017/08/29/rhme3-exploitation-writeup/).