The vuln function has a stack buffer overflow vulnerability. But even if a return address is modified, the program will terminate abnormally because a stack canary exists.
However, this challenge it seems we can modify something called fsbase before the vuln function is called.