PWN me!

spbctf

Task: menu-driven heap manager (strings + ints) with a classic Use-After-Free — remove_* frees chunks without nulling the slot pointer. Solution: alias a freed 0x10 string struct with an int struct (tcache reuse) to build arbitrary read/write, leak PIE via a stored funcptr and libc via GOT %s, then overwrite __free_hook with system and free a '/bin/sh' buffer (avoiding the glibc 2.27 movaps alignment crash on a direct funcptr call).