1. Leak libc by reading from unsorted chunk2. Free fast chunk of size 0x703. Free another fast chunk of size 0x704. vote for chunk freed in '3', will increment fd pointer. vote 0x20 times to make fd pointer point inside [2] chunk5. [2] chunk should have a fake chunk pointing to \_\_malloc\_hook - 0x236. Overwrite with one shot gadget