pwn8_logger — logger_easy!(not) — UAF/alias + tcache poison

spbctf

Task: menu-driven C++ logger over glibc 2.31 with UAF (DelLogger doesn't NULL slot) and no bounds-checking re-use. Solution: 5-phase heap chain — (1) UAF aliasing to turn a tcache linked-list pointer into a printf format leaking heap, (2) unsorted-bin libc leak via guard-chunk trick, (3) create enabled trigger slot pointing at \"/bin/sh\" in libc, (4) tcache poison __free_hook via alias-chaining P_a→P0, (5) DelLogger(7) → system(\"/bin/sh\").