Hack.lu 2018 - Heap Heaven II

Aribitrary free & aribitrary leak, because there is code pointer on the heap, we almost could leak everything. Then an unlink attack to modify the mmapped pointer on the bss.