secret_v2 — format string without %n

spbctf

Task: format-string bug with a filter that bans the byte 'n' (so no %n) but still allows %s; secret is stored in BSS at a fixed No-PIE address and later compared against user input. Solution: plant the secret's address on the stack by placing it inside the input buffer and dereference it with %11$s to leak the secret, then echo the secret back to retrieve the flag.