more Pager Shell Escape

more is a terminal pager — and like its more capable sibling less, it doubles as a shell escape when it can be run with elevated privileges (a sudo NOPASSWD entry, a SUID binary, or a forced-command context). GTFOBins catalogs more under both Shell and File read functions.

Interactive mode is the gate

more only accepts interactive commands when it is actually paging — i.e., when the file is longer than the terminal height. Two practical consequences:

• more behaves like cat for short files; a one-line file can never be escaped through, because no prompt ever appears.
• To force interactive mode on a short file, shrink the terminal window (or set LINES) below the file’s line count.

Once interactive:

• v invokes an editor — $VISUAL, then $EDITOR, then vi by default. From vi/vim, a :!sh or :shell escape produces a shell (see vim-shell-escape).
• !command runs a command directly via $SHELL -c command. !/bin/bash is the canonical root-shell one-liner.

The sudo path

If `sudo -l` shows a NOPASSWD entry for more (or for a wrapper that pages output):

sudo more /var/log/some-long-file
!/bin/bash          # at the pager prompt — root shell

The ! command is executed with $SHELL -c, so the escape fails silently if the invoking user’s shell in /etc/passwd is exotic (/sbin/nologin, /bin/false, a restricted shell). The same failure mode applies to ssh user@host command — an invalid login shell breaks non-interactive command execution in ways that are easy to misdiagnose.

Sources

• GTFOBins — more
• more(1) — Linux manual page
• SSH commands fail with non-standard shell in /etc/passwd — Stack Overflow

Related: sudo-nopasswd-recon, vim-shell-escape, suid-shell-executable, unix-permissions