@0x29A said:
Not stuck, already solved it. I am wondering why the 64 byte offset is required when referring to the server libc “/bin/sh” vs no offset on my local libc.
You are getting %s%s… string on remote right ?
Because remote offset of bin_sh is a bit different.
If you search offset for %s%s… string in your local libc you will see that address is actually remote address of bin_sh.
So you need to do some calculation. Substract from that address your bin_sh addres.
Than you will find the value you need to substract from your bin_sh address to get a real address of bin_sh.