Fastbin dup to overwrite pointer to top chunk.

Original writeup (https://amritabi0s.wordpress.com/2018/04/02/0ctf-quals-babyheap-writeup/).