tl;dr

• Make fake fastbin chunk with size of 8, then free that to overwrite max_fast
• Do another free, with size pointing to linker got table
• Then write shellcode and exit

script

Original writeup (https://thekidofarcrania.gitlab.io/2019/06/13/0ctf19-finals/).