Learn why untrusted text must not be used as a printf format string, then use the bug to inspect program memory.
Start with the "Start here" resource below. It explains what printf does
with its format string, where printf finds its values, and how to read them
back out. Suggested order: fmt-leak, then fmt-read.