A textbook printf(buf) with eight tries, leaking PIE and libc off the stack then overwriting printf@got with system in a single format call
A hand-rolled printf with an undocumented %w specifier that writes one vararg to the address in another, turned into a GOT overwrite on strcspn
