fake2 (Mic Check 2 / mc2.elf)

spbctf

Task: glibc 2.31 heap pwn (PIE/Full RELRO/canary/CET) with a singly-linked list of 0x48 chunks; edit() has a single-byte off-by-one on the LSB of the global HEAD list pointer. Solution: use the free printf libc leak, forge a fake chunk via the HEAD-LSB overwrite so delete() frees an attacker-controlled address and hands over HEAD, tcache-poison __free_hook to system, then free a fake chunk whose first 8 bytes are '/bin/sh' for a root shell.