less — Shell Escape

less is the standard UNIX pager. When allowed via sudo NOPASSWD or set SUID, it provides a shell-escape — cataloged in GTFOBins.

Shell escape via sudo

If less can be run with passwordless sudo (check sudo -l):

sudo less /etc/hosts
!/bin/sh

Inside less, ! passes the rest of the line to the shell, yielding a root prompt.

Why pagers are dangerous

less is the default pager for man, git, systemctl, and many other tools. Any command that opens output in less is potentially a shell-escape vector. GTFOBins catalogs less under Shell, Command, File write, and File read.

Detection and hardening

• Sudo rules: sudo -l reveals NOPASSWD entries; pagers are escape hatches.
• SUID audit: find / -perm -4000 -type f 2>/dev/null (see find-command) should never list less.
• Restricted shells: For restricted accounts, avoid relying on rbash alone — less can escape via :e (edit file) or ! (shell command). Prefer removing less from $PATH or using more (which lacks shell escapes on some builds, though GTFOBins catalogs it too).

Sources

• GTFOBins — less

Related: man-shell-escape, vim-shell-escape, suid-shell-executable, unix-permissions, find-command