We are taking the following steps in order to exploit the program.  1. Leak the remote libc (puts is printed at the start, we can use [libc-database](https://github.com/niklasb/libc-database).  2. Create a soldier and give it a big enough answer_length (0x50 is enough).  3. Promote the soldier, which frees it.  4. Create a soldier again with answer_length of -1 causing malloc to fail. By doing so we will have ```soldier_struct->answer_length = -1``` and ```global_answer_length = 0x50```.  5. Promote the soldier. This time alloca won't actually allocate more memory. We can overflow into the return address and form a rop-chain.  6. Enjoy the shell :)  