RedpwnCTF penpal_world

spbctf

Task: heap exploitation challenge with UAF/double-free in glibc 2.27 tcache, menu-based allocator with 2 slots and 34 operations. Solution: tcache double-free for heap leak, chunk size forgery (0x51→0x91) to reach unsorted bin for libc leak, tcache poisoning to overwrite __free_hook with system(), trigger via free(\"/bin/sh\").