A Brainfuck interpreter runs with a data tape. The tape pointer can move left into the process memory - giving arbitrary read/write. Exploit chain: Move tape pointer left into the GOT section with < operators, use . to leak puts() address from GOT to compute libc base, then compute system() = libc_base + offset. Use , to write system() address over putchar@GOT. When interpreter calls putchar, it calls system("/bin/sh") instead.