This is one of the all-time great exploit writeups.
> Why the 32-bit edition? I’m not going to lie: I wanted to give myself a break. I was expecting this to be pretty hard so going after the problem in the 32-bit space gives us just a few more options in our trusty exploitation toolkit.
https://web.archive.org/web/20080430162146/http://www.matasa...
(The original post on the matasano.com server seems to have been eaten; any chance that could be resurrected, tptacek?)