Rating:

Shellcode needs to be split up into two small buffers. Call the first buffer to execute the first part of the shellcode plus a jump to the second buffer, that contains the second part of the shellcode.

Original writeup (https://0xf4b1.github.io/ctftime/tuctf.com/pwn/3step/).