**tl;dr**

+ Race condition to change the type.
+ Leak using uninitialized memory and get rip with overflow.

**Challenge Points:** 1000
**No of Solves:** 1
**Challenge Author:** [3agl3](https://twitter.com/3agl31)

Original writeup (https://blog.bi0s.in/2021/08/18/Pwn/InCTFi21-MultiStorage/).