1. using `idx = 0` leak one of menu string ptr addr2. calculate flag addr based on leak3. using `idx = 0` overwrite one of menu string ptr with flag addr4. leak flag by printing menu 
Please follow the detailed writeup [here](https://github.com/irGeeks/ctf/tree/master/2017-CSAW/firewall)