Given + x86, no protections + Custom heap + Out of bounds write + Unsafe Unlink + rwx heap+stack
```cstruct chunk{  int size;  struct chunk * fd;  struct chunk * bk;  char space[size];}```
Solution : + Allocate a few chunks+ Overflow into the next chunk to replace fd and bk with GOT['strcpy'] and shellcode jump address.+ spray a region with asm("jmp dword[esp+8]")+ trigger strcpy with controlled parameter as shellcode
Script [here](https://gist.github.com/sudhackar/cd75961a2cad86527acf9eb911b28aff)