Tl;dr: dumped bozo.bin with shellcode, and got rip control by overwriting the return address on the stack.
Full writeup in link.