ulnk2

spbctf

Task: ELF heap challenge with fixed malloc(0x800), UAF (delete doesn't NULL slot), and heap overflow (edit allows 0xfff into 0x800 chunk). Solution: Unsorted bin leak for libc/heap, forge chunk headers via overflow to create largebin-sized chunks, largebin attack overwrites _IO_list_all, House of Apple 2 FSOP triggers system(' sh') on exit.