VIM OR VI as SUDO

🔓 Privilege escalation with Vim/Vi when running as SUDO

One of the classic privilege escalation vectors on Linux appears when a user has permission to run vim or vi with sudo (for example, via an entry in /etc/sudoers like (ALL) NOPASSWD: /usr/bin/vim). Although at first glance it may seem like a harmless permission -“it can only” edit files-, in reality it’s enough to obtain a shell with root privileges. Vim includes the ability to launch an internal shell, and if the editor itself is running as root, that shell inherits the same privileges.

💡 Step 1 — Change Vim’s internal shell

Once inside Vim (in command mode), we configure which shell it should use internally:

:set shell=/bin/sh

💡 Step 2 — Invoke the shell

With the shell already configured, we launch it directly from Vim:

:shell

This opens a /bin/sh session within the context of the Vim process. If Vim was running with sudo, that shell will also be root.

💡 Direct alternative

We can also skip the step of configuring the shell and launch one directly from Vim’s command mode:

!/bin/bash

The ! prefix in Vim executes an external command, and in this case that command simply opens a Bash shell, with the same privileges as the parent process.

🚫 Why does this work?

The flaw isn’t in Vim itself, but in the sudo configuration. Any binary that allows running arbitrary commands, opening a shell, or invoking other programs (editors, pagers, interpreters, network tools…) is dangerous if granted sudo without restrictions. Vim is just one of the best-known examples, extensively documented on GTFOBins.

✅ Best practices

If you need to grant sudo permissions on an editor like Vim, always check GTFOBins before granting the permission, avoid NOPASSWD unless strictly necessary, and consider restricting dangerous internal commands with sudoers (for example, through wrappers or more granular policies). In an audit, checking the user’s sudo -l permissions and comparing them against binaries known to allow shell escapes should be one of the first steps.

🔐 Conclusion

A seemingly harmless sudo permission on a text editor can translate into a root shell within seconds. Vim and Vi are perfect examples of why the principle of least privilege must also -and especially- be applied to tools we consider “safe” out of habit.