1) Leak the stack address2) Partial overwrite of the main ret address (it points to libc_start_main). With an overwrite of the last 2 bytes we can jump in the main function again.3) Leak the binary address4) Jump again in the main5) Get an infinite loop with a stack pivoting and write a ropchain in the memory6) Exit the infinite loop and jump in the ropchain
Full exploit herehttps://github.com/r00ta/myWriteUps/tree/master/InsomnihackTeaser2019