Used format string vuln to rewrite exit@plt to print_flag() address..