Please, do not write just a link to original writeup here.

Original writeup (https://www.lazenca.net/display/TEC/Pwn-Sleepy+Holder%28300%29+-+Solved+by+1+Teams).