You can simply replace `return` address with the address of the function that runs shell.

Original writeup (https://github.com/sajjadium/ctf-writeups/tree/master/CSAWQuals/2018/get_it).