Just2Free

spbctf

Task: heap note-manager where free() leaves a dangling STROCHKEE[] pointer and modify_string only checks the stale SIZES[] entry (UAF). Solution: alias a live 40-byte string over a struct executor via a tcache-key-bypass double free (reallocate the chunk to clear its key before re-freeing), overwrite command with /bin/sh, and trigger system().