A little different than the rest. We didn't realize libruby.2.2.so had system('/bin/sh') built in.

Original writeup (http://bitsforeveryone.blogspot.com/2015/09/writeup-csaw-2015-exploitation-400.html).