It's a simple brainf\*\*k interpreter.As we can read from and write to arbitrary addresses, we can overwrite the return address of `main` and call the `flag` function.
[writeup](https://ptr-yudai.hatenablog.com/entry/2019/04/25/141422#Binary-150pts-Over-My-Brain)