Tags: stack-pivot format-string pwn off-by-one rop 

Rating:

Original writeup (https://github.com/datajerk/ctf-write-ups/tree/master/downunderctf2021/oversight).