Rating:

tl;dr

  • Make fake fastbin chunk with size of 8, then free that to overwrite max_fast
  • Do another free, with size pointing to linker got table
  • Then write shellcode and exit

script

Original writeup (https://thekidofarcrania.gitlab.io/2019/06/13/0ctf19-finals/).