This program is vulnerable to a format string attack! See if you can modify a variable by supplying a format string! The binary can be found at /home/format/ on the shell server. The source can be found here[1].

hint:There is already a pointer to the variable on the stack! Also, %n may be useful!