Unintended solution according to author.

This challenge is difficult to write an exploit for, so hopefully I explained things well. Please use GDB to debug the script yourself if you want to analyze it.

Original writeup (https://gist.github.com/farazsth98/ec8ea2869d1e76ea4a7a3cc96fe328ff).