I've been following walkthroughs for various exploit exercises for linux applications. I understand the content of these well enough, however some refer to using cat to "keep the pipe open", e.g. here.

For example:

(python2 exploit.py ; cat) | ./programToExploit

What does "keeping the pipe open" actually mean in practice, and how is the pipe being kept open as with the command above?

  • I've always wondered this, too. – wogsland Mar 1 '17 at 19:06

Did you try it?

See the difference between

echo 'ls' | sh -s


( echo 'ls'; cat ) | sh -s


{ echo 'ls'; cat; } | sh -s

Here, sh -s will start a shell session that reads commands to execute from standard input (-s).

In the first example, the shell will simply execute ls and exit (since there's no more input).

In the second and third example, the shell will execute ls and then wait until there's no more input. The input stream to sh -s was first generated by the echo command, but then cat took over the role. The cat process will read from the parent shell session and pass commands through the pipe to sh -s. If you type ls, or any other commands (there will be no prompt to type it at), the shell will execute those commands.

This will continue until you terminate the cat process by pressing Ctrl+D on an empty line to signal end of input.

I believe that is what you mean by "keeping the pipe open".

  • Yes, I tried it and it worked as the author(s) described, I mostly just wanted to understand why it worked and why the subshell was necessary. Your answer covers this, so thanks. – plunkspeaker Mar 1 '17 at 18:40
  • This is a cool little trick! – wogsland Mar 1 '17 at 19:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.