Identifier / Programs / Linux and Unix
nvim
Neovim, a programmer's text editor based on Vim, provides several modes for different kinds of text manipulation. Pressing <i> in normal mode enters insert mode. <Esc> or <Ctrl c> goes back to normal mode, which doesn't allow regular text insertion. tldr-pages
GTFOBins file-read, inherit 4 documented commands
How nvim is abused
file-read
-cinherit
-cEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for nvim.
4 documented commands
GTFOBins documents nvim with the commands of vim.
file-read unprivileged, with sudo, as SUID
vim -c ':redir! >/path/to/output-file | echo "DATA" | redir END | q'Trips no Sigma process-creation rule.
inherit unprivileged, with sudo, as SUID
This allows to run Python code (...).
vim -c ':py ...'Trips 1 Sigma rule: highVim GTFOBin Abuse - Linux by Nasreddine Bencherchali (Nextron Systems), Luc Génaux
inherit unprivileged, with sudo, as SUID
This allows to run Lua code (...).
vim -c ':lua ...'Trips 1 Sigma rule: highVim GTFOBin Abuse - Linux by Nasreddine Bencherchali (Nextron Systems), Luc Génaux
2 of the 4 commands the identifier reads trip a Sigma process-creation rule; 2 trip none. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for nvim. The identifier reads the line of each that runs vim.
Everyday use
Open a file
nvim path/to/fileIdentifyEnter text editing mode (insert mode)
<Esc><i>Copy ("yank") or cut ("delete") the current line (paste it with <p>)
<Esc><y><y>The example the identifier reads matches no GTFOBins abuse and trips no Sigma process-creation rule.