Use the double free to stimulate heap overflow and do house of orange with size of the unsorted bin chunk set to 0xb1 instead of 0x61.
[https://amritabi0s.wordpress.com/2018/05/01/asis-ctf-quals-2018-fifty-dollors-write-up/](https://amritabi0s.wordpress.com/2018/05/01/asis-ctf-quals-2018-fifty-dollors-write-up/)

Original writeup (https://amritabi0s.wordpress.com/2018/05/01/asis-ctf-quals-2018-fifty-dollors-write-up/).