pwn10_nosoeasy — No-So-Easy: tcache poison → GOT overwrite

spbctf

Task: heap allocator bounded to size 0x20, 16 slots, NO read primitive on heap data, flag stored in arr[0] chunk at init. Solution: glibc 2.27 double-free → tcache poison to return free@got, overwrite it with printf@plt; remove(0) now calls printf(arr[0]) which prints the flag. fgets size carefully chosen so its mandatory NUL doesn't damage adjacent GOT entries.