Rating: 2.0
Simple two-stage rop - first to leak an address from the GOT, and then to bounce to a magic libc gadget in the provided libc.so.
https://advancedpersistentjest.com/2018/04/01/writeups-so_stealthy-rescue-shell-nuit-du-hack-quals/
I don't remember
