Use realloc(ptr,0) to get double free. Do fastbin corruption and overwrite realloc_hook.

Original writeup (https://vignesh362.wordpress.com/2018/02/01/acebear-ctf-memo_heap-writeup/).