ROPme now...

You don’t need to write to a buffer, everything can be done using gadgets or functions in the PLT. You do need to gain a shell