I love that NiNi Chen's (https://blog.terrynini.tw/) Mikrotik RADVD exploitation involves old-school fun like delay slots, encoding RISC instructions into IP addresses, and flushing the i-cache/d-cache: https://forum.defcon.org/node/245713 (live stream @ https://m.twitch.tv/defcon_dctv_one)