/challenge/pwn/fmt-string/vuln is a setuid-root echo service: it passes your input straight to printf as the format string. The binary has no canary and is built with -z norelro.
Use %n writes (e.g. overwrite an entry in .fini_array or a GOT slot with the address of win) to get the flag from /flag.