Mic Check: leak and write (mc2)

spbctf

Task: glibc 2.31 menu-driven heap allocator (mc2) with UAF (delete doesn't clear slot), a puts-based leak primitive, and a raw write-what-where option. Solution: unsorted-bin libc leak from a freed large chunk with a guard, then use the arbitrary write to set __free_hook = system, and free('/bin/sh') to pop a shell.