I recommend you to check if the 0x0804b795 address is writable.

You can see the different regions of a running process in `/proc/PID/maps`. For example:

<!-- language: lang-bash -->

    $ sleep 10 &
    [1] 1438
    $ cat /proc/$(pgrep -f 'sleep 10')/maps
    08048000-0804d000 r-xp 00000000 08:01 399565     /bin/sleep
    0804d000-0804e000 r--p 00005000 08:01 399565     /bin/sleep
    0804e000-0804f000 rw-p 00006000 08:01 399565     /bin/sleep
    084b4000-084d5000 rw-p 00000000 00:00 0          [heap]
    [...]

In this case only the addresses between 0804e000-0804f000 and 084b4000-084d5000 are writable.

Inside GDB, you can use `info proc` or `info inferior` to get the PID of the debugged program.

Also, keep in mind that `%n` will write an integer value, not a single character. I mean, in this case it will write 4 chars (in little-endian). But you can use `%hhn` to write a single character.

I recommend you to read http://jbremer.org/format-string-vulnerabilities/ and to look the documentation in [`printf(3)`](https://linux.die.net/man/3/printf).