1. Create player1, set 0x21 for all fields2. Add, Select, Remove player2 to get dangling pointer3. Edit player2 via dangling pointer to point at player1 data4. Write the address of strlen() in GOT to player2 name (overwriting player1 name pointer)5. Edit player1 name, dereferencing GOT pointer and overwriting GOT address6. Point strlen to gadget to shift stack7. ROP to clear a couple of registers before hitting /bin/sh one gadget