Rating: 5.0

Double free on chunks in tcache. Leak of the heap -> Leak of the ELF -> Leak of the libc -> writing malloc hook with a gadget

[Writeup](https://github.com/LorenzoBinosi/CTF/tree/master/2018/HitconCTF/pwn/Groot)