basic exploitable test script works... but found bugs