In the wake of the recent buzz and trend in using DDE for executing arbitrary command lines and eventually compromising a system, I asked myself « what are the coolest command lines an attacker could use besides the famous powershell oneliner » ?
I’ve recently been looking into a fancy covert channel, targeting Windows familly operating systems, for either:
- deliver various malicious payloads (shellcode, binaries, scripts, whatever…)
- use it as a C2 communication channel
This is what this blog post is all about. Let’s dig into it.
NB: This article is not about how Fail2Ban works or how to install it.
If you’re running an Internet facing server, you probably know its exposed services are constantly being probed and attacks are being attempted against it. Fortunately, an extremely useful, nice and nifty tool is here to help: Fail2Ban.
Fail2Ban scans service’s log files for patterns defined as regular expressions and, if an offending pattern is found a certain number of times within a given timeframe, the corresponding source IP is banned (ie: blocked) for a configurable time, using local firewall rules such as iptables.
I’m very touchy when it comes to my server security so I’m using Fail2Ban to perform permanent bans of involved source IPs and I’m going to show you how. The problem however is that those bans do not persist across a Fail2ban server restart or a server reboot.
In this article I will show you how to add two simple lines in Fail2Ban configuration file in order to add persistency across restart.