# TL;DR1. Find a UAF in the `midnight()` method for JS typed arrays2. Exploit the UAF to get a libc leak3. Exploit the UAF to perform a tcache poison attack4. Set `__free_hook` to `system`5. Free a chunk containing `cat *la*`6. Win
Follow the link for the full writeup.