Steps to pwn:1. Out of bounds array access vulnerability2. Use out of bounds vuln to leak the canary and saved return pointer of main which will give us the load address of __libc_start_main+93. Subtract 9 from leaked return pointer and find the libc version in libc-databases or construct your own leak function by using puts/printf from GOT or PLT to leak the whole libc.4. Construct payload with canary, calculated address of system and calculated address of the string "/bin/sh" in libc.