tl;dr:1. Notice that assignment to integer typed variable performs arithmetic evaluation2. Notice that array index calculation has full-eval power3. Place payload as index of an array to gain RCE
Full writeup: https://github.com/p4-team/ctf/tree/master/2019-10-19-seccon/multiplicate