tl;dr

• Overflow from stdin stucture till main_arena.
• Create fake fastbin chunks to get overlapping chunk and leak.
• Overwrite __malloc_hook using fastbin attack.

tl;dr

• overflow the char candle counter stored in the wax structure and trigger uaf.
• Use the uaf to trigger double free and get shell.