I would like a tutorial on actually writing to a particular address by exploiting format-string vulnerabilities.

P.S: The topic title should be changed to "Format String Vulnerabilities" as its not only the case with printf, all functions that support format strings are vulnerable to this attack over to shabbir.