tl;dr

• Reverse to find unique function not containing bad stack canary
• Libc leak using format string vulnerability in printf
• ROP chain to get shell