App - System

hi everyone
I have been stuck at this problem for a week ... ( ELF 32 Blind remote format string bug )
i have leaked the code but couldn’t understand it well
I have leaked got_addr and libc_addr and resolved many func’s got_addr
i now know system_addr and write,snprintf got_addr
but i am unable to proceed further kindly help me !!!