- using a buffer overflow, we load our own seccomp filter
- with a specific seccomp filter, we bypass glibc's hardening techniques
- we overwrite the secret key stored in memory and get the flag
For a detailed description, follow the link :D