Blackhat MEA CTF Final 2025 – pwn/stack-prelude

Forcing recv() to return early by sending urg tcp packet!

Blackhat MEA CTF Final 2025 – pwn/verifmt

Leaking stack via partial format strings %*N$