DoubleFormat

spbctf

Task: heap exploitation binary with UAF in two allocation types (simple chunks and struct chunks) sharing the same tcache bin, Partial RELRO, glibc 2.31, PIE/system leaked at startup. Solution: UAF struct-alias to overwrite struct's ptr/size fields, then arbitrary write system to free@GOT via fgets with careful size control to avoid newline corruption.