Identifier / Programs / Linux and Unix
view
Vim (Vi IMproved), a command-line text editor, provides several modes for different kinds of text manipulation. Pressing <i> in normal mode enters insert mode. Pressing <Esc> goes back to normal mode, which enables the use of Vim commands. tldr-pages
GTFOBins file-read, inherit 4 documented commands
How view is abused
file-read
-cinherit
-cEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for view.
4 documented commands
GTFOBins documents view with the commands of vim.
file-read unprivileged, with sudo, as SUID
vim -c ':redir! >/path/to/output-file | echo "DATA" | redir END | q'Trips no Sigma process-creation rule.
inherit unprivileged, with sudo, as SUID
This allows to run Python code (...).
vim -c ':py ...'Trips 1 Sigma rule: highVim GTFOBin Abuse - Linux by Nasreddine Bencherchali (Nextron Systems), Luc Génaux
inherit unprivileged, with sudo, as SUID
This allows to run Lua code (...).
vim -c ':lua ...'Trips 1 Sigma rule: highVim GTFOBin Abuse - Linux by Nasreddine Bencherchali (Nextron Systems), Luc Génaux
2 of the 4 commands the identifier reads trip a Sigma process-creation rule; 2 trip none. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for view. The identifier reads the line of each that runs vim.