tl;dr* Make fake fastbin chunk with size of 8, then free that to overwrite `max_fast`* Do another free, with size pointing to linker got table* Then write shellcode and exit 
[script](https://gist.github.com/theKidOfArcrania/a19bd300b9ee9acfb4e22279a86c1a3a)