Tags: pwn 

Rating: 5.0

Solve after game

GOT hijack---------------

use top chunck size to create "\xc3"(ret)

forge strdup to return address on stack

forge puts to call read on stack(now rip is on the stack)

write shellcode and done!!

Original writeup (https://github.com/st424204/ctf_practice/blob/master/isitdtu/dead_note/dead_note_lv3.py).