[kvakil]

This looks like a nice variety of challenges! I've always found constructing ROP chains extremely satisfying, even more than regular exploit development.

As a plug, I wrote a blog post solving a similar exercise using a ROP chain: http://www.kvakil.me/posts/ropchain/ . It looks pretty similar to the pivot challenge here.