1) leak libc + heap since chunks are not null'd when they are free'd2) create a fast chunk between some small chunks3) use house of einherjar to create overlapping chunks4) free fast chunk5) use fastbin attack to overwrite fast chunk's FD ptr w/malloc_hook offset6) overwrite malloc_hook w/one_shot7) trigger memory corruption