Expressway — HTB Writeup | The Hack Sparrow

Executive summary — Expressway is an unusual Easy Linux box: almost the whole attack revolves around IKE/IPsec. Enumerating the service in Aggressive Mode we capture the PSK hash, crack it by dictionary, and the PSK turns out to be the password for user ike over SSH. Once inside, Squid logs reveal an internal hostname (offramp.expressway.htb) and a hand-installed copy of sudo under /usr/local/bin. That combination opens the door to CVE-2025-32462, a bypass of sudoers' host-matching via sudo's -h flag that lets a rule meant for another host be applied locally. Path: IKE PSK -> ike -> sudoers host bypass -> root.

Platform	Hack The Box
Operating system	Linux
Difficulty	Easy
Status	Retired
Target IP	`10.10.11.87`

Attack map

[UDP 500] IKE/IPsec in Aggressive Mode -> leaks the PSK hash
   |  psk-crack (rockyou) -> cleartext PSK
   v
[SSH]  ike  (user.txt)  (the PSK is the password)
   |  sudo -l -> anomalous behaviour
   |  Squid logs -> internal hostname "offramp.expressway.htb"
   |  which sudo -> /usr/local/bin/sudo (vulnerable build, not the system one)
   v
[ROOT] CVE-2025-32462 (sudo -h sudoers host bypass) -> root

1. Reconnaissance

echo "10.10.11.87 expressway.htb" | sudo tee -a /etc/hosts

Before anything aggressive, a quick sweep with Nmap's default scripts confirms open ports and banners without too much noise.

nmap -v --script=default 10.10.11.87

With the ground covered, we go deeper with version/OS detection and full NSE:

nmap -v -A -sV 10.10.11.87
# 22/tcp open  ssh  OpenSSH 10.0p2 Debian 8

TCP has little more than SSH. Before attempting a login, we check which authentication methods it accepts —password, public key—, since that decides whether it's worth looking for a password elsewhere:

nmap -sV --script ssh-auth-methods -p 22 10.10.11.87

The real hint is on UDP: we check whether an IKE/IPsec service is listening on port 500.

sudo nmap -sU -p 500 10.10.11.87     # 500/udp open  isakmp

Environment note: during recon a tinyssh service was also observed on a different IP in the range; it's contextual lab-environment data, not part of this machine's attack path.

Resumen ejecutivo — Expressway es un Linux Easy poco habitual: casi todo el ataque gira en torno a IKE/IPsec. Enumerando el servicio en Aggressive Mode capturamos el hash de la PSK, lo crackeamos por diccionario y la PSK resulta ser la contraseña del usuario ike para SSH. Ya dentro, unos logs de Squid revelan un hostname interno (offramp.expressway.htb) y una copia de sudo instalada a mano en /usr/local/bin. Esa combinacion es la puerta a CVE-2025-32462, un bypass del host-matching de sudoers mediante la opcion -h de sudo que permite aplicar localmente una regla pensada para otro host. Recorrido IKE PSK -> ike -> sudoers host bypass -> root.

Plataforma	Hack The Box
Sistema operativo	Linux
Dificultad	Easy
Estado	Retired
IP objetivo	`10.10.11.87`

Mapa del ataque

[UDP 500] IKE/IPsec en Aggressive Mode -> filtra el hash de la PSK
   |  psk-crack (rockyou) -> PSK en claro
   v
[SSH]  ike  (user.txt)  (la PSK es la password)
   |  sudo -l -> comportamiento anomalo
   |  logs de Squid -> hostname interno "offramp.expressway.htb"
   |  which sudo -> /usr/local/bin/sudo (build vulnerable, no la del sistema)
   v
[ROOT] CVE-2025-32462 (sudo -h bypass de host en sudoers) -> root

1. Reconocimiento

echo "10.10.11.87 expressway.htb" | sudo tee -a /etc/hosts

Antes de lanzar nada agresivo conviene un barrido rapido con los scripts por defecto de Nmap: confirma puertos abiertos y banners sin generar demasiado ruido.

nmap -v --script=default 10.10.11.87

Con el terreno acotado, vamos a fondo con deteccion de version, SO y NSE completo:

nmap -v -A -sV 10.10.11.87
# 22/tcp open  ssh  OpenSSH 10.0p2 Debian 8

El TCP casi solo tiene SSH. Antes de intentar login, comprobamos que metodos de autenticacion acepta —password, clave publica—, ya que eso condiciona si merece la pena buscar una contraseña en algun otro sitio:

nmap -sV --script ssh-auth-methods -p 22 10.10.11.87

La pista real esta en UDP: comprobamos si hay un servicio IKE/IPsec escuchando en el puerto 500.

sudo nmap -sU -p 500 10.10.11.87     # 500/udp open  isakmp

Nota de entorno: durante el reconocimiento tambien se observo un servicio tinyssh en otra IP distinta del rango; es un dato contextual del entorno de laboratorio, no forma parte del camino de ataque de esta maquina.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.