Srop and rop, then run shellcode.

Original writeup (https://ex-origin.github.io/2019/10/08/Balsn-CTF-2019-PWN-writeup/).