Partial writeup - the solution works only for a local libc.
https://github.com/disconnect3d/writeups/blob/master/pwn_ISITDTU_CTF_2018_quals_babyformat/solve.py

Original writeup (https://github.com/disconnect3d/writeups/blob/master/pwn_ISITDTU_CTF_2018_quals_babyformat/solve.py).