The idea is that you are advancing printf's stack pointer internally towards a memory location with our payload. Internally printf has a stack of arguments that are passed into. Using %x you can advance down the stack until you get to the right location in memory (looks like it's 0x988 in this case). Once you put the stack pointer at that location you use %n to write some data into memory. This is basically where we launch our attack and try to take over, the next instruction becomes our payload after printf and exploit() starts running at that point. The first link below has a good explanation of how the stack pointer is advanced towards the payload and the second goes a little more in-depth on how the attack works at the assembly/memory level. http://www.cis.syr.edu/~wedu/Teaching/cis643/LectureNotes_New/Format_String.pdf http://codearcana.com/posts/2013/05/02/introduction-to-format-string-exploits.html The short story is you're abusing the fact that memory is contiguous as far as your app is concerned to predict where important variables are in memory and then further abusing how printf works to force it to write over it's own stack. You can fire up GDB and use the j, x, set and disas commands (among others) to take a peek at the assembly of a running program and mess around with it if you're so inclined. More on reddit.com

As you found, %x will pop bytes off the call stack. %08x will print 4 bytes and you can enter multiples of these to walk up the stack.

You now have addresses on the stack and you can print the contents of that memory with %s.

By chance have you tried %n? It should cause a write.

Check this paper for more info https://cs155.stanford.edu/papers/formatstring-1.2.pdf

More on reddit.com

Could you provide an excerpt so people can look at it? More on reddit.com

how I can manipulate it to write to a memory address of my choice.

printf being a varadic function doesn't know how many arguments it was sent, it just sees a format specifier, and reads the next argument.

So the simple answer here is you get the location you want to write to as the next argument it reads. So where is it getting the arguments? Probably off the stack. It expects the arguments to be pushed onto the stack before calling, so it just pops off whatever value happens to be there. Its a little more complicated because you have to account for calling conventions, but all conventions that come to my mind right now, will put varadic arguments on the stack. (So to answer your "%p%p" question, its just whatever pops off the stack next.)

So you need to get a value you desire onto the stack, then you "pop" off all the values until you're about to hit your value, which is where you plant the %n so it sees %n, pops your value off and writes to it. Getting your value onto the stack depends on the application and the level of control you have. There is a reasonably chance though at some pointer earlier in teh stack some data you influence will be there, so a common technique is just to %x or %p (both just reflect the value read directly) until you find something you controlled.

More on reddit.com