First you'll probably need to enable support for the %n character as it is disabled by default on some operating systems. The vulnerable program would have to have the following statement:
Next, you will need to determine where the return address you wish to overwrite is stored on the stack. In this case, you could overwrite either the return address of
main. One of these locations you will need to overwrite with the value 00112233.
You must overwrite the return address one byte at a time by generating an input to
printf to be the equivalent of
The first %n will effectively write a zero or null byte to the return address LSB since the total number of characters printf has written at that point is zero. The second %n will print the value 11 to the second byte of the return address, the third 22, and so on. I'll leave it as an exercise for you to craft the actual buf payload.