tcache on libc 2.27 UAF

Original writeup (https://github.com/joshdabosh/writeups/blob/master/2020-RedpwnCTF/pwn/Four-Function-Heap.md).