Use the rename function to get a heap leak. Use the rename function with a fastbin attack to get a libc leak by faking an unsorted chunk afterwards in the name section of BSS. Then, perform an House of Orange attack.

Original writeup (https://www.willsroot.io/2019/10/picoctf-2019-sice-cream-writeup.html).