bitflit + ret2libc 
full expl: http://www.hamidx9.ir/solutions/2016/plaidctf/butterfly/sol.py

Original writeup (http://www.hamidx9.ir/blog/2016/01/19/plaidctf-2016-pwnable-butterfly-writeup.html).