iftop — Shell Escape

iftop is a real-time network bandwidth monitor that displays per-connection throughput. When allowed via sudo NOPASSWD or set SUID, it provides a shell-escape — cataloged in GTFOBins.

Shell escape via sudo

If iftop can be run with passwordless sudo (check sudo -l):

sudo iftop
!/bin/sh

Inside iftop, press ! to open a shell command prompt, then type /bin/sh to spawn a root shell.

Requirements

• iftop version: 0.17 or later (the ! shell command was added in this release).
• Privileges: iftop requires packet-capture privileges (CAP_NET_RAW or root). SUID iftop is rare in practice; sudo NOPASSWD is the more common misconfiguration.

Detection and hardening

• Sudo rules: sudo -l reveals NOPASSWD entries; network monitors with interactive shells are escape hatches.
• SUID audit: find / -perm -4000 -type f 2>/dev/null (see find-command) should never list iftop.
• Consider granting CAP_NET_RAW via file capabilities instead of full SUID or sudo: setcap cap_net_raw+ep /usr/sbin/iftop.

Sources

• GTFOBins — iftop

Related: vim-shell-escape, suid-shell-executable, unix-permissions, find-command