Leak the canary with the format string !
system("/bin/sh") is in the binary