return to shellcode in stack

Original writeup (http://taqini.space/2020/04/19/UMDCTF-2020-Pwn-writeup/#Easy-Right-150pt).