Bof

Using printf to first leak libc/pie, then overwriting a global variable which gives us a write primitive which is suspecitble to buffer overflow, then simple rop.