Identifier / Programs / Linux and Unix
vimdiff
Open up two or more files in vim and show the differences between them. tldr-pages
GTFOBins file-read, inherit 1 Sigma rule name it 4 documented commands
How vimdiff is abused
file-read
-cinherit
-cEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for vimdiff.
4 documented commands
GTFOBins documents vimdiff with the commands of vim.
file-read unprivileged, with sudo, as SUID
vim -c ':redir! >/path/to/output-file | echo "DATA" | redir END | q'Trips no Sigma process-creation rule.
inherit unprivileged, with sudo, as SUID
This allows to run Python code (...).
vim -c ':py ...'Trips 1 Sigma rule: highVim GTFOBin Abuse - Linux by Nasreddine Bencherchali (Nextron Systems), Luc Génaux
inherit unprivileged, with sudo, as SUID
This allows to run Lua code (...).
vim -c ':lua ...'Trips 1 Sigma rule: highVim GTFOBin Abuse - Linux by Nasreddine Bencherchali (Nextron Systems), Luc Génaux
2 of the 4 commands the identifier reads trip a Sigma process-creation rule; 2 trip none. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for vimdiff. The identifier reads the line of each that runs vim.
What detects it
Everyday use
Open two files and show the differences
vimdiff path/to/file1 path/to/file2IdentifyMove the cursor to the window on the left|right
<Ctrl w><h>Jump to the previous difference
<[><c>The example the identifier reads matches no GTFOBins abuse and trips no Sigma process-creation rule.