nano — Shell Escape

nano is the ubiquitous beginner-friendly terminal editor. When it is allowed via sudo NOPASSWD or set SUID, it becomes a reliable shell-escape and privilege-escalation vector — cataloged in GTFOBins.

Shell escape via sudo

If nano can be run with passwordless sudo (check sudo -l), break out into a root shell with nano’s built-in file-read/execute feature:

1. CTRL+R (read file)
2. CTRL+X (execute file)
3. reset; sh 1>&0 2>&0

The reset clears the screen; sh 1>&0 2>&0 spawns a shell with stdin/stdout/stderr wired back to the terminal so you get an interactive prompt.

SUID nano

If nano is installed SUID root, the same ^R^X sequence works — but only on systems where the shell does not drop SUID privileges (see suid-shell-executable for how bash handles this with -p).

Detection and hardening

• Sudo rules: sudo -l reveals NOPASSWD entries; any editor is an escape hatch.
• SUID audit: find / -perm -4000 -type f 2>/dev/null (see find-command) should never list an editor.
• Prefer removing nano from $PATH for restricted accounts over relying on rbash; see vim-shell-escape for how editors defeat naive shell restrictions.

Sources

• GTFOBins — nano

Related: vim-shell-escape, suid-shell-executable, unix-permissions, find-command