TL;DR Arbitrary overwrite

Overwrite free_hook with system and pop shell

Complete write up [here](https://jkrshnmenon.wordpress.com/2017/10/19/hack-lu-2017-heapheaven-write-up/)

Original writeup (https://jkrshnmenon.wordpress.com/2017/10/19/hack-lu-2017-heapheaven-write-up/).