Format string vulnerability not showing values on the stack

Question

PROBLEM

I am trying to put together a short demonstration of a simple hack for a presentation about cyber-security. I thought about using a format string vulnerability, and heavily inspired by this video i put together this demo:

// main.c
#include <stdio.h>
#include "secret.h"

void testPassword() {
  char password[64];
  char input[128];

  readPass(password); // puts the secret into password

  printf("Password: ");
  scanf("%127s", input);

  printf("\nYou typed:\n");
  printf(input); // vuln

  if (strcmp(password, input) == 0) {
    printf("\n...Senha correta!\n");
  } else {
    printf("\n...Voce errou :(\n");
  }
}

int main() {
  testPassword();
}

// secret.h
#include <string.h>

#define pass "bcc_unesp_2024"

void readPass(char buff[64]) {
  strcpy_s(buff, 64*sizeof(char), pass);
}

Separating it into two files for presentations sake. I intend to show how the basics of the exploit work and ultimately use this python script to find the password and other interesting values:

import pwn

pwn.context.log_level = "critical"

programa = pwn.ELF("./a.out")

for i in range(0, 256):

    payload = b"".join([
        b"%" + str(i).encode("utf-8") + b"$s"
    ])

    pty = pwn.process.PTY
    p = programa.process(stdin=pty, stdout=pty)

    p.recvuntil(b"senha: ")
    p.sendline(payload)
    response = p.recvall().decode("latin-1")
    print(response)

After running this many enviorement variables, nonsense strings, and seg faults are displayed as expected, but the password is nowhere to be found. I am using wsl2 for writing this code, and I got the same results when thesting on a Ubuntu 20.04.6 LTS virtual box, and compiling with GCC 11.4.0 without any flags, just gcc main.c

I appreciate any help or suggestions regarding this demonstration If any informations is missing, dont hesitate to ask, thank you in advance :)

I have tried:

• putting all the code in one file
• declaring and defining password in the scope of the function directly
• searching for pointers with %p and hex values with %x in the python script
• going through the code with gdb and looking at values after $sp (the stack pointer), where I was able to find the desired password, but I couldnt replicate this with the python script

the original code if you need it: https://github.com/argArthur/Demonstracao-cyber.git