Identifier / Programs / Linux and Unix
rvim
GTFOBins file-read, inherit 1 Sigma rule name it 4 documented commands
How rvim is abused
file-read
-cinherit
-cEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for rvim.
4 documented commands
GTFOBins documents rvim with the commands of vim.
file-read unprivileged, with sudo, as SUID
vim -c ':redir! >/path/to/output-file | echo "DATA" | redir END | q'Trips no Sigma process-creation rule.
inherit unprivileged, with sudo, as SUID
This allows to run Python code (...).
vim -c ':py ...'Trips 1 Sigma rule: highVim GTFOBin Abuse - Linux by Nasreddine Bencherchali (Nextron Systems), Luc Génaux
inherit unprivileged, with sudo, as SUID
This allows to run Lua code (...).
vim -c ':lua ...'Trips 1 Sigma rule: highVim GTFOBin Abuse - Linux by Nasreddine Bencherchali (Nextron Systems), Luc Génaux
2 of the 4 commands the identifier reads trip a Sigma process-creation rule; 2 trip none. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for rvim. The identifier reads the line of each that runs vim.