Rating:

The attack surface on the panel directly is too small. However, it receives input from the bear npcs. Therefore, we will hack the panel via the bear. Bears have this rom flashing port, so we just reprogram them directly. Then we just do a really simple overflow on a data array to corrupt an adjacent function pointer to shellcode.

Original writeup (https://github.com/perfectblue/ctf-writeups/tree/master/csaw-ctf-2018-finals/beararms).