FAIL2BAN
OFFSEC - Proving Grounds - ARIN
·2673 words·13 mins
OFFSEC PG PRACTICE
WHOIS
LOCAL SMTP SERVER
FAIL2BAN
RWHOIS
Port 43 WHOIS and an ARIN web app expose registered data. After signup, SMTP receives the link. RWHOIS manipulation and a Fail2Ban tilde escape enable RCE and root access.
OFFSEC - Proving Grounds - FAIL
·2555 words·12 mins
OFFSEC PG PRACTICE
RSYNC
FAIL2BAN
Upload SSH key via rsync for initial access. Abuse fail2ban’s actioncheck in iptables-multiport.conf and trigger it by failed SSH logins to escalate to root.