1. Malloc a chunk large enough to get malloc to call mmap and give you a chunk aligned to libc2. Overwrite free hook to system using out of bounds relative write3. Call system("ed") to bypass hexadecimal char only filter4. Escape ed to shell by doing !/bin/sh
Detailed writeup at the link