Unintended solution according to author.
This challenge is difficult to write an exploit for, so hopefully I explained things well. Please use GDB to debug the script yourself if you want to analyze it.