TUCTF 2017: Guestbook (250)

We are given an ELF executable file, guestbook and a service for the executable. Our goal is to spawn a shell from the service. Decompiling guestbook with IDA will yield this C pseudo-code:

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char s; // [sp+0h] [bp-98h]@16 …