[full writeup with script](https://ctf.hgar.xyz/2018/uiuctf/how2heap/)

Characters are stored in a binary max heap on the stack. There is a logic error in the delete method that allows for overwriting the "count" variable and then achieving arbitrary writes.

Shell is obtained by leaking libc and overwriting saved return address with magic gadget.