Kernel Adventures 2: build the shellcode path, control execution, and read the flag.
pwn
Kernel Adventures 2: build the shellcode path, control execution, and read the flag.
El Teteo: build the shellcode path, control execution, and read the flag.
DearQA: shape the heap state, gain the needed write or leak, and pivot to flag access.