1. using `idx = 0` leak one of menu string ptr addr
2. calculate flag addr based on leak
3. using `idx = 0` overwrite one of menu string ptr with flag addr
4. leak flag by printing menu

Please follow the detailed writeup [here](https://github.com/irGeeks/ctf/tree/master/2017-CSAW/firewall)

Original writeup (https://github.com/irGeeks/ctf/tree/master/2017-CSAW/firewall).