Log Search==========
Pretty straightforward printf vulnerability. pwntools will do theheavy lifting for us. The main key to this one is to do itefficiently.
We could put in a lot of effort and get full execution control. Butall we need is the flag. Studying the log search function providesus with a quicker path to the flag -- overwrite the log filename withflag.txt, overwrite strstr with printf, and instead of searching thelog for a search query, it will print every line from the flag.
One thing to watch out for: GOT entries are pointers to executablecode and PLT entries are executable code. You can't overwrite a GOTentry with a pointer to a GOT entry because that makes it a pointerto a pointer to executable code. Overwriting it with an entry toanother PLT entry makes it a pointer to executable code even thoughit will take you through the PLT/GOT twice. In this instance,execution will look like: strstr@plt -> strstr@got -> printf@plt ->printf@got -> printf@libc.