Demo on exploiting a format string vulnerability

How can we change the state of a variable? If the program has a format string vulnerability we can indeed modify the state and change the control flow of the program. We show a demo.