Disclaimer: I did not solve this during the CTF.
This is a very detailed analysis of Balsn's exploit script for this challenge.
I have removed some parts of the exploit that were redundant, and changed some parts of the exploit script to fix what I removed.
The stack pivoting technique that is used by Balsn in this exploit script is something I've never seen before, and it is absolutely amazing.
Hopefully the writeup is useful.