The binary has a Format String Bug.We can overwrite the GOT addrees of `perror` and `printf` in order to get the shell.
[writeup](https://ptr-yudai.hatenablog.com/entry/2019/03/25/152043#Pwn-998pts-Simple)