pwn9_mc4 — Mic Check: leak and pwn!

spbctf

Task: menu-driven glibc 2.31 heap allocator where delete() doesn't NULL the slot, making print and edit usable on freed chunks. Solution: unsorted-bin leak via a chunk > tcache max and a guard to prevent top-consolidation; tcache poisoning by editing the freed chunk's fd to __free_hook; write system into __free_hook; free('/bin/sh') → shell.