Getting RCE without an info leak

Hi,

I have a question to the more experienced exploit devs:

I'm currently on a challenge where I'm exploiting a heap-based buffer OOB write. I'm able to overwrite the arena completely wherever I want (malloc_state, tcache, ...) and I'm also able to arbitrarily malloc() any sized buffer and write attacker controlled bytes to that new buffer, multiple times.

I'm struggling though because the binary has no infoleak or anything, it's not a server/daemon based binary where I can launch an info leak first and bypass ASLR like that. It's the last challenge, a difficult challenge to say the least. But I feel like the ability to poison tcache and then call malloc on any tcachebin (and do this N times) is a powerfull primitive, and I get this itch that this should be powerfull enough to do some feng shui stuff that gets me RCE.

I'm wondering what techiques has gotton you leakless RCE before? Stuff like house of Roman isn't possible because I'm on glibc 2.43 (latest) so safelinking is present. Could anyone point me in the right direction? House of Apples 2 also needs STDOUT which I don't have.

Details:

It's a Linux 64bit ELF binary, all protections enabled (aslr, stack canaries, pie and full relro) with glibc 2.43.