Rating:

Using UAF to overwrite vtable pointer:

https://kileak.github.io/ctf/2017/BCTF-BabyUse/

Original writeup (https://kileak.github.io/ctf/2017/BCTF-BabyUse/).