1 - Leak GlibC from the GOT.
2 - return to main again
3 - system("/bin/sh")

Original writeup (https://pwn-maher.blogspot.com/2020/11/pwn13-ret2libc-and-ret2shellcode.html).