[pwnable] - _IO_FILE structure and vtable overwrite