I managed to exploit it locally but the behaviour was very different from the remote challenge! Remote was easier. The difference was that on remote, calling free() twice caused a crash (double free) but on my machine, calling free() twice did not trigger that crash. On my machine, calling free() 9 times triggered the crash. Could anyone add some insight into why there exist such different behaviours?