1. Heap overflow when View -> Modify
2. Use this to overwrite next chunk's pointers
3. View/Modify on next chunk gives arbitrary r/w primitives
4. Leak libc address from GOT
5. Replace strcmp's GOT with system
6. Pass /bin/sh to strcmp while entering option in menu

Original writeup (https://github.com/DhavalKapil/ctf-writeups/blob/master/codegate-2018/super-marimo/exploit.py).