Change the next pointer of the first node to achieve arbitrary memory write change __free_hook to system

Original writeup (https://pwn-maher.blogspot.com/2020/11/pwn12-corrupting-next-pointer-of-linked.html).