I am working on a CTF where I need to pass an address as input to a program. This address contains the value 0x09 (the tab character). This is causing me problems, because it seems that bash is interpreting the tab before it is input to the actual program.

Say I have a simple bash script:

#!/usr/bin/env bash

echo $1

I would then like to pass e.g. "1"+"\x09"+"2" and have the output from the program be: "1\x092".

However the tab character moves the "2" to the second argument and it is then not echoed.

Currently if I do

./script.sh $(python -c 'print "1"+"\x09"+"2"')

It just echos "1". Is there a way to keep the three characters tied together?

Thanks in advance

3 Answers 3


You're solution doesn't take into account the tab character. It gets interpreted as a space. See here:

ch3rn0byl@ch3rn0byl:~$ ./scripts.sh "$(python -c 'print "1" + "\x09" + "2"')" | hexdump -C
00000000  31 20 32 0a                                       |1 2.|

If you modify your script, you can do something like this:



echo -ne $a

That way you can modify it or whatever.

ch3rn0byl@ch3rn0byl:~$ ./scripts.sh 1 2 | hexdump -C
00000000  31 09 32                                          |1.2|

Anyhow, ignore if this wasn't what you were going for. Have fun!


You just need to wrap the input in quotation marks. Like so:

./script.sh "$(python -c 'print "1"+"\x09"+"2"')"


printf '\x31\x09\x32' | xargs python script.py

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.