man — Shell Escape

man is the UNIX manual page viewer. When allowed via sudo NOPASSWD or set SUID, it provides a shell-escape through its pager — cataloged in GTFOBins.

Shell escape via sudo

If man can be run with passwordless sudo (check sudo -l):

sudo man man
!/bin/sh

man opens its output in a pager (typically less). From the pager, ! passes the rest of the line to the shell, spawning a root prompt.

How it works

man does not spawn a shell itself; it relies on the PAGER environment variable (defaulting to less -s). The escape happens in the pager, not in man proper. This means:

• If PAGER is set to a non-interactive command (e.g., cat), the ! escape fails.
• The same technique works with any command that pipes through a pager (git help, systemctl status, etc.).

Detection and hardening

• Sudo rules: sudo -l reveals NOPASSWD entries; any command that invokes a pager is an escape hatch.
• SUID audit: find / -perm -4000 -type f 2>/dev/null (see find-command) should never list man.
• Pager restrictions: For restricted accounts, set PAGER=cat or MANPAGER=cat to disable interactive pagers — but prefer removing man from $PATH entirely, since users can override env vars.

Sources

• GTFOBins — man

Related: less-shell-escape, vim-shell-escape, suid-shell-executable, unix-permissions, find-command