Ipzz281 Full __exclusive__ -

Using ROPgadget (or pwndbg 's rop command) we locate the necessary gadgets in the binary and in libc.