# Fail2ban Privilege Escalation

Fail2Ban is an intrusion prevention software framework that protects computer servers from brute-force attacks.

Seeing as this was what fred had access to, I had to research it and any privilege escalations I can find regarding it.&#x20;

![](https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FPSmjyE19qK33GkpfCZVX%2FResearching%20fail2ban.PNG?alt=media\&token=410e0d4d-23ad-47bd-98bb-f4e8ca775c00)

What I found from - <https://grumpygeekwrites.wordpress.com/2021/01/29/privilege-escalation-via-fail2ban/>

"There are two things **actionban** and **actionunban**. If we have write access to this file, we can add our malicious command and escalate our privileges."

Needed to check if it was still running on the machine i SSH'd into.&#x20;

![](https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FlI0UTwpZwww0asI1KBX0%2FChecking%20the%20status%20of%20fail2ban.PNG?alt=media\&token=8b54fee5-2bdd-4c2b-8d65-19316d6fd14c)

Seeing as it is still running, I changed directories to fail2ban

![](https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FPPXj1845ofBygWJgbajo%2Fchanging%20CD%20to%20fail%20to%20ban%20and%20seeing%20my%20permissions.PNG?alt=media\&token=ef5447d4-cf33-4840-a7f9-d59a4335e15b)

changed directories to action.d

When i changed Directories to action and then listed everything. I could see that fred owned a file..

![](https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FtnRaALU6HJf0Z38fJd6P%2FCD%20to%20action%20and%20checked%20privs%20to%20see%20fred%20owned%20a%20file.PNG?alt=media\&token=977fe39a-79c5-4dc0-ab61-b50e27b01644)

Once i vim'd into the "iptables-multiport.conf" file&#x20;

![before picture of the vim file](https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2Fbzkqn798RVHBLgmq7bpG%2FCopy%20of%20changes%20made%20with%20the%20vim%20file.PNG?alt=media\&token=1b5196b6-dc0e-49fe-9084-75f3abc87d82)

![After I made changes to the vim file ](https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2F79i8fcuJL5KTXskKhWsx%2FEdited%20the%20file%20to%20change%20actionban%20and%20actionunban.PNG?alt=media\&token=6a812d91-6298-4335-b1c3-7ba5e2261378)

Now I am going to modify where a machine is banned, Im going to change it to equal a privilege escalation. Also doing it on both **actionban** and **actionunban** which ensures I do not break anything I'm unaware of.&#x20;

![](https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FY9rH85dL77a7vCJXnYVE%2FCurrently%20watching%20it.PNG?alt=media\&token=d14f7c97-a1b0-470e-b4d4-525b5cbb3cd7)

```bash
watch -n 0 ls -la /bin/bash
```

With the code above I was able to watch the privilege above to see if it changes.&#x20;

With the code below, i made another terminal then tried to constantly SSH in, which blocked the second machine out and escalated the privileges of my first machine that was already inside.&#x20;

![](https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FTKyaxwGrN1uIXc8CectQ%2FAfter%20watching%20privileges%20have%20changed%20after%20I%20failed%20ssh%20twice.PNG?alt=media\&token=01adf222-8395-4cc6-8d13-246dc2009c60)

With bash -p I am able to see i have escalated to root.

With this access I am able to get the final root flag&#x20;

![](https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FdvhuD1LjDaNrZvY7bIsf%2Fwatching%20then%20bashing%20and%20finding%20the%20root%20txt.PNG?alt=media\&token=25e5b362-34c1-44f9-8246-d5341d2574b8)

\\

\\
