mask@mask-virtual-machine:~/CTF/Defcon2015_R0pbaby$ ./r0pbaby 

Welcome to an easy Return Oriented Programming challenge...
Menu:
1) Get libc address
2) Get address of a libc function
3) Nom nom r0p buffer to stack
4) Exit
: 1
libc.so.6: 0x00007FFFF7FF79B0
1) Get libc address
2) Get address of a libc function
3) Nom nom r0p buffer to stack
4) Exit
: 2
Enter symbol: system
Symbol system: 0x00007FFFF7857640
1) Get libc address
2) Get address of a libc function
3) Nom nom r0p buffer to stack
4) Exit
: 3
Enter bytes to send (max 1024): 2
ab
1) Get libc address
2) Get address of a libc function
3) Nom nom r0p buffer to stack
4) Exit
: Bad choice.

char *pwnme()
{
  char s; // [sp+0h] [bp-20h]@1

  memset(&s, 0, 0x20uLL);
  puts("Hope you read the instructions...");
  printf("> ", 0LL);
  return fgets(&s, 256, stdin);
}