Rating:

Original writeup (https://github.com/0x90r00t/Write-Ups/blob/master/nullcon2017/Exploit1/solve.py).