iz_heap_lv1 — BSS-pointer overlap + tcache poisoning

spbctf

Task: ISITDTU 2019 heap challenge (glibc 2.27) where arr[20] aliases a global name buffer, giving a pointer-table write primitive via Show-Name(Y); broken bounds let you free/edit index 20. Solution: forge fake chunks in BSS, fill tcache[0x90], free the fake 0x90 chunk into unsorted bin to leak libc via %s past a non-NUL newline byte, then re-forge a 0x30 chunk, double-free it into tcache[0x30], poison its fd to __free_hook, write system there, and free a chunk containing '/bin/sh' to spawn a shell.