The Corroded Crown

CACTF2026

Task: menu-driven heap allocator (forge/inscribe/inspect/destroy) with a use-after-free because read/write operations ignore the in_use flag and free never nulls the pointer, on glibc 2.31. Solution: UAF read on an unsorted-bin chunk leaks libc, then tcache poisoning (no safe-linking) redirects an allocation onto __free_hook, overwriting it with system and triggering free() on a /bin/sh chunk for a shell.