Villager B450 points

Released at: 2012/06/12
To be more secure I enabled several security options as follows:
- Randomized addresses of the program (-pie)
- Protected the stack (-fstack-protector-all)
- Made GOT read-only (-Wl,-z,relro,-z,now)
- Executed via xinetd
- Inserted a wait in order to prevent brute force attacks
- Ascii armor is enabled

Can you still crack it?
nc ctfq.u1tramarine.blue 10023
ncat --ssl ctfq.u1tramarine.blue 20023

Hint:
- The program is villager
- The flag is in /home/q23/flag.txt
- This will help you: libc.so.6
- Outbound packets are filterd. So, you cannot use (reverse) shells.