1. Heap overflow when View -> Modify2. Use this to overwrite next chunk's pointers3. View/Modify on next chunk gives arbitrary r/w primitives4. Leak libc address from GOT5. Replace strcmp's GOT with system6. Pass /bin/sh to strcmp while entering option in menu