Format string exploit builder

printf(user_input) instead of printf("%s", user_input) is one of the most powerful bugs there is. The format string controls how many arguments printf reads and what it does with them - so it grants both an arbitrary read and, via %n, an arbitrary write.

Step one: find your offset

Send AAAA followed by a run of %p. The output is a sequence of stack values, and one of them will be 0x41414141 - your own input, being read back as an argument. Count its position and you have the offset that %<n>$p needs to address your buffer directly.

$ ./vuln
AAAA.%p.%p.%p.%p.%p.%p
AAAA.0x7ffd8f30.0x0.0x7f9e2c0.0x41414141.0x2e70252e.0x252e7025
#                                  ^ offset 4 - your input

Step two: write with %n

%n writes the number of characters printed so far to the address given by the corresponding argument. Combine that with a width specifier to control the count - %100c%7$n writes 100 to whatever address sits at offset 7. Writing a full address means writing four bytes; do it two bytes at a time with %hn to keep the character counts manageable, since %n with a large value would otherwise require printing billions of characters.