Fail
Gaining Access
Nmap scan:
$ nmap -p- --min-rate 3000 -Pn 192.168.243.126
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-17 21:08 +08
Nmap scan report for 192.168.243.126
Host is up (0.17s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
873/tcp open rsyncRsync was the only thing available.
Rsync Enum -> SSH
Hacktricks has a whole page for RSync we can follow:
We can first do further enumeration on the modules available:
fox might be the user present on the machine. We can list the files present:
What we do is create a new .ssh directory and place our public key within it:
Then, transfer it to the machine:
Then, we can ssh in:
Privilege Escalation
Fail2ban -> Root
The user is able to edit the fail2ban configuration files to execute commands as root since fox is part of that group.
We just need to create a malicious iptables-multiport.conf file like this:
Afterwards, replace the actual file with our malicious one, where the actionban has been edited.
To trigger it, just generate a lot of ssh tries with hydra:
We would then get a reverse shell back as root:
Last updated