Writeup writen in Chinese.
Steps:1. leak memcpy_got2. write printf_plt to memcpy_got and make up a Format String bug3. use FSB to craft a leak function4. use DynELF to leak system address5. write system address to memcpy_got6. trigger memcpy_got again and get shell.
Exp: [https://gist.github.com/cubarco/9bfafbc77dd2c0330e3c0ef87013c6fa#file-bank-exp-py](https://gist.github.com/cubarco/9bfafbc77dd2c0330e3c0ef87013c6fa#file-bank-exp-py)