leak and write2 (mc3)

spbctf

Task: glibc 2.31 menu-driven heap allocator with fixed malloc(0x800), a delete that NULLs slots (no UAF), and an arbitrary 8-byte write-what-where option. Solution: leak libc via unsorted-bin fd by re-allocating a freed 0x810 chunk with size=0 (read loop skipped, fd survives) then puts it; overwrite __free_hook with system and free a '/bin/sh' chunk for a shell.