You can simply overwrite the value in stack based on which "/bin/bash" will be executed.

Original writeup (https://github.com/sajjadium/ctf-writeups/tree/master/CSAWQuals/2018/bigboy).