Unintended solution with some fancy ROP tricks. https://github.com/4NONYM4U5/CTF-Writeups/tree/master/darkctf/rrop

Original writeup (https://github.com/4NONYM4U5/CTF-Writeups/tree/master/darkctf/rrop).