The [link](https://www.win.tue.nl/~aeb/linux/hh/hh-11.html) the hint provides us sort of leads us on the right track, but the program's malloc in this challenge is slightly different.  Just following the tutorial's ideas will not work.  I used it as my basis and found the differences in the way malloc behaves with gdb.  Then, you can use shellcode to jump to the win function.