Double free on chunks in tcache. Leak of the heap -> Leak of the ELF -> Leak of the libc -> writing malloc hook with a gadget
[Writeup](https://github.com/LorenzoBinosi/CTF/tree/master/2018/HitconCTF/pwn/Groot)