This challenge has a `stack overflow` vulnerability. Basically, you can overwrite the return address with the address of your `shellcode`, by which you can spawn `/bin/sh` by calling `execve` system call.