Threadweaver Challenge Scenario

hackthebox

Task: 64-bit PIE ELF task manager with worker thread, stale UAF (delete doesn't clear slot), Full RELRO + glibc 2.39. Solution: cross-thread tcache overflow to unsorted bin for libc leak, tcache poison into BSS task table, stdout copy-relocation pointer overwrite for FSOP via _IO_wfile_jumps wide-stream path, PIE delta brute-force.