Dream Diary - Chapter 1

Hello i tried to pwn this challange and looked similar ctf write-ups and understand behind the attack. I can trick the malloc and i can anyaddress address which i want. But i am doing these with ASLR close and i have no idea how to leak any addresses from binary cuz similar ctf problems containing print options which in this case i have not. Any help would be greateful

secret#6195 feel-free to pm on discord please