Rating:
https://github.com/0x90r00t/Write-Ups/blob/master/nullcon2017/Exploit1/solve.py
I don't remember