The description and source code can be found here:
This level is largely the same as the previous, except now we need to set the changeme variable to a specific value (0x45764f6c). We know we can overflow the dest variable with the “%x” format specifier. We can use a number before the “x” to specify how many characters to print. For example, the fill the 32 byte buffer for the dest variable, we can use “%32x”. Then we’ll simply append the required bytes for the changeme variable.
user@phoenix-amd64:~$ echo -e "%32x\x6c\x4f\x76\x45" | /opt/phoenix/amd64/format-one Welcome to phoenix/format-one, brought to you by https://exploit.education Well done, the 'changeme' variable has been changed correctly!