Modified duktape JS engine, use OOB R/W to overwrite function pointer and gain RCE.
[https://zeroload.github.io/ctf/2019/05/14/DEF-CON-Quals-2019-Speedrun-12/](https://zeroload.github.io/ctf/2019/05/14/DEF-CON-Quals-2019-Speedrun-12/)

Original writeup (https://zeroload.github.io/ctf/2019/05/14/DEF-CON-Quals-2019-Speedrun-12/).