In short:
- Use pop to control a `read` syscall
- Use `read` to write a new shellcode

Original writeup (https://github.com/noAuxy/writeups/blob/master/2019/2019-04-28-StarCTF.md#babyshell).