TryHackMe Billing Room: Exploiting MagnusBilling Command Injection and fail2ban Escalation

This TryHackMe walkthrough targets the Billing machine, built on MagnusBilling, an open-source VoIP billing platform that runs alongside the Asterisk PBX. The initial foothold comes from an unauthenticated command injection flaw in the IcePay payment gateway integration, where an unvalidated parameter is passed into a shell context. The write-up explains how chained shell operators allow an attacker to fetch and execute a remote script for a reverse shell. The privilege escalation route abuses fail2ban, a security daemon, by manipulating its client binary to alter how banning actions are executed. The room is presented as a useful example of domain-specific attack surfaces in telephony software.