Used ret2libc to system() to get shell

Original writeup (https://www.whitehatters.academy/csaw-2015-prequals-exploit-250-contacts/).