Simple ret2win exploit.
It calls read on rbp-0x20, reading 0x38 bytes.
This is enough for 16 bytes after RBP.
We simply send 0x28 junk bytes + ret gadget + win_win function address(win_win is a function executing cat flag.txt whilst the ret gadget is for stack alignment)
For some reason I had to put an interactive session just when I connected to the server and hit control c so that the exploit continued in order for it to work...