### tl;dr

+ Overflow from `stdin` stucture till `main_arena`.
+ Create fake `fastbin` chunks to get overlapping chunk and leak.
+ Overwrite `__malloc_hook` using fastbin attack.