spnow

(python -c 'print "payload"'; cat -) | nc pwnable.url
(echo payload; cat) | ./pwnable

cat payload - | ./pwnable

Awesome Pwnable

malloc.c - malloc() implementation in glib-2.23 (as found in Ubuntu 16.04.1 LTS)
how2heap - Awesome collection of various heap exploitation techniques

Download & Install Sublime Text 3.2.2 Build 3211
Visit https://hexed.it/
Open file select sublime_text.exe
Offset 0x8545: Original 84 -> 85
Offset 0x08FF19: Original 75 -> EB
Offset 0x1932C7: Original 75 -> 74 (remove UNREGISTERED in title bar, so no need to use a license)

	#!/usr/bin/python
	#
	# Pickle deserialization RCE payload.
	# To be invoked with command to execute at it's first parameter.
	# Otherwise, the default one will be used.
	#

	import cPickle
	import os
	import sys

	@echo off
	::::::::::::::::::::::::::::
	set "params=Problem_with_elevating_UAC_for_Administrator_Privileges"&if exist "%temp%\getadmin.vbs" del "%temp%\getadmin.vbs"
	fsutil dirty query %systemdrive% >nul 2>&1 && goto :GotPrivileges
	:: The following test is to avoid infinite looping if elevating UAC for Administrator Privileges failed
	If "%1"=="%params%" (echo Elevating UAC for Administrator Privileges failed&echo Right click on the script and select 'Run as administrator'&echo Press any key to exit...&pause>nul 2>&1&exit)
	cmd /u /c echo Set UAC = CreateObject^("Shell.Application"^) : UAC.ShellExecute "%~0", "%params%", "", "runas", 1 > "%temp%\getadmin.vbs"&cscript //nologo "%temp%\getadmin.vbs"&exit
	:GotPrivileges
	::::::::::::::::::::::::::::
	color 1F