tl;dr
* Make fake fastbin chunk with size of 8, then free that to overwrite `max_fast`
* Do another free, with size pointing to linker got table
* Then write shellcode and exit

[script](https://gist.github.com/theKidOfArcrania/a19bd300b9ee9acfb4e22279a86c1a3a)

Original writeup (https://thekidofarcrania.gitlab.io/2019/06/13/0ctf19-finals/).