* Overflow pointer of `name`.
* Change name to overwrite fake fd -> leak.
* Checkout to overflow pointer of `name` to fake fd;
* Change name -> gothijacking.
* [exploit](https://github.com/ssspeedgit00/CTF/tree/master/2018/PCTF/shop)

Original writeup (https://github.com/ssspeedgit00/CTF/tree/master/2018/PCTF/shop).