Plan:

1. Manipulate stack position to store libc address
2. Transform address to point to one-gadget
3. possibly zero rcx
4. overwrite saved rip with one-gadget

one-gadget for libc version at offset:
0x4f29e execve("/bin/sh", rsp+0x40, environ)
constraints:
address rsp+0x50 is writable
rsp & 0xf == 0
rcx == NULL || {rcx, "-c", r12, NULL} is a valid argv