Firstly, I used rop chain(stage 1) to leak puts address from the system. In this way, I specified the libc address. Then I created a second-rop chain to get a shell.