Identifier / Programs / Linux and Unix

ex

Vim (Vi IMproved), a command-line text editor, provides several modes for different kinds of text manipulation. Pressing <i> in normal mode enters insert mode. Pressing <Esc> goes back to normal mode, which enables the use of Vim commands. tldr-pages

GTFOBins shell 1 ATT&CK technique 2 documented commands

How ex is abused

documented by GTFOBins

shell T1059.004 Command and Scripting Interpreter: Unix Shell

-c

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for ex.

2 documented commands

from GTFOBins, each read by the identifier

inherit unprivileged, with sudo, as SUID

ex

Identify

shell unprivileged, with sudo, as SUID

ex -c ':!/bin/sh'

Identify

None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for ex. The identifier reads the line of each that runs ex.

What detects it

Sigma process creation rules

T1059.004Command and Scripting Interpreter: Unix Shell

Everyday use

from tldr-pages, CC BY 4.0

Open a file

vim path/to/fileIdentify

Open a file at a specified line number

vim +line_number path/to/fileIdentify

View Vim's help manual

<:>help<Enter>

None of the 2 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.

ex

How ex is abused

2 documented commands

What detects it

Everyday use

Other programs abused for shell