Use uaf in cancel() to create overlaping free chunks. Edit inner chunk size to make it a fastbin and then fastbin dup to overwrite malloc_hook.

Original writeup (https://amritabi0s.wordpress.com/2018/03/12/n1ctf-2018-vote-writeup/).