Walkthrough Osaka – OffSec Proving Grounds: format string → ASLR bypass, ROP chain con VirtualAlloc → DEP bypass, shellcode e SeDebugPrivilege → SYSTEM.