Use the rename function to get a heap leak.  Use the rename function with a fastbin attack to get a libc leak by faking an unsorted chunk afterwards in the name section of BSS.  Then, perform an House of Orange attack.