There exists an out-of-bounds vulnerability when choosing the unary.
We abuse this to leak the libc address and inject a ROP chain.

[writeup](https://ptr-yudai.hatenablog.com/#182pts-Unary-20-solves)

Original writeup (https://ptr-yudai.hatenablog.com/#182pts-Unary-20-solves).