Starting from the 6th argument (%6$), values are taken from [rsp]. The 7th argument (%7$) comes from [rsp+8], and the 8th argument (%8$) comes from [rsp+0x10].

When printf() is called, the user’s input is stored starting at the rsp location. By crafting the payload so that the address of changeme is placed at [rsp+0x10], the %8$n format specifier can then be used to write a value into the changeme variable.