Hi @caladay,
I suggest having a look at the community solution, there is a bit of trial and error to get the gas left:
(There are a number of community solutions for the different levels: Ethernaut Community Solutions).
Alternatively you can look at the attack in the repository:
https://github.com/OpenZeppelin/ethernaut/blob/solidity-05/contracts/attacks/GatekeeperOneAttack.sol