← Back to Writeups
HTB Practice Lab

Expressway

Original practice notes covering UDP enumeration, TFTP and IKE discovery, PSK recovery, SSH access, and local privilege escalation.

Hack The BoxLinux
This page is a direct HTML transfer of my original practice notes. The technical content, commands, findings, and attack path have been kept intact rather than rewritten into a different walkthrough.

First Flag

Recon and Enumeration

  • The target IP is 10.129.5.230, so I began my recon with nmap.

  • The first command I ran is as follows:

    • nmap -sV -A -O -Pn 10.129.5.230

  • This command resulted in the following: ```Starting Nmap 7.95 ( https://nmap.org ) at 2026-01-15 13:19 EST Nmap scan report for 10.129.5.230 Host is up (0.044s latency). Not shown: 999 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 10.0p2 Debian 8 (protocol 2.0) Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.19 Network Distance: 2 hops Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

      TRACEROUTE (using port 993/tcp)
  HOP RTT      ADDRESS
  1   45.81 ms 10.10.14.1
  2   46.17 ms 10.129.5.230
  ```

  • A single SSH service does not seem like a feasible path to gain a foothold. So I ran nmap -p- 10.129.5.230 to try to discover any other ports.

  • This scan resulted in the same results as before, but I have not scanned for any UDP ports, so I will follow up on a scan for that.

  • The next command I ran was to find UDP ports:

    • nmap -sV -sU 10.129.5.230

  • and that command resulting in the following: ```PORT STATE SERVICE VERSION 68/udp open|filtered dhcpc 69/udp open tftp Netkit tftpd or atftpd 199/udp open|filtered smux 500/udp open isakmp? 1023/udp open|filtered unknown 4500/udp open|filtered nat-t-ike 19632/udp open|filtered unknown 49194/udp open|filtered unknown

  • The first service, [[tftp]], seemed liked a good starting place. So I read more into the service

  • After reading about service, it seems there are no commands to navigate the file system. So I went back to reading about ways to exploit [[tftp]]

  • I referred to hackviser which had a list of tactics to enumerate and exploit tftp.

  • Within this page was a specific nmap command to enum files within tftp:

    • nmap -sU -p 69 --script tftp-enum 10.129.5.230

  • This command found a file called "ciscortr.cfg", which is a default config file for cisco devices.

  • Running grep 'password' on this file resulted in the following: no service password-encryption enable password ***** username ike password ***** key secret-password group 2 key secret-password password ***** password *****

  • This reveals a user named 'ike', but not much else to work with.

  • I pivoted focus to port 500 because it is the only other open port on the UDP scan.

  • I read about the service [[isakmp]] on angelica.github.io

  • This taught me about what isakmp is and some basic enumeration and exploitation of the service.

  • Following the website's enumeration tactics, i ran the following command:

    • ike-scan -M -A 10.129.5.230

  • This command resulting in the following: HDR=(CKY-R=5dcb4160bcc7a644) SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800) KeyExchange(128 bytes) Nonce(32 bytes) ID(Type=ID_USER_FQDN, Value=ike@expressway.htb) VID=09002689dfd6b712 (XAUTH) VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0) Hash(20 bytes)

  • This response gave me a lot of valuable information. Including the hashing algorithm (SHA1), the authentication type (pre-shared key) and a user (ike@expressway.htb).

  • I did more reading about the ike-scan tool, and learned that if you have the user information, you can initiate a handshake that has the hash of the password.

  • So i ran the following command to attempt to grab a hash:

  • That command resulted in a hash value saved to expressway_hash.txt

  • I first ran the hash through hashcat but the resulted password would not grant me access, so I opted for psk-crack instead.

    • psk-crack -d /usr/share/wordlists/rockyou.txt expressway_hash.txt

  • This got me the following password:

    • freakingrockstarontheroad

  • Using the credentials ike/freakingrockstarontheroad, I was able to SSH into the machine.

  • And in the home dir was a file called user.txt that had the first flag in it.

Second Flag

This flag took me a couple days to find, I had to do a lot of researching on figuring out what I need to look for and what i can exploit.

After some digging, I found a possible avenue of attack on the specific version of sudo installed on the target machine

Running dpkg -s sudo resulted in: Package: sudo Status: hold ok installed Priority: optional Section: admin Installed-Size: 6054 Maintainer: Sudo Maintainers <sudo@packages.debian.org> Architecture: amd64 Version: 1.9.13p3-1+deb12u1 Replaces: sudo-ldap Depends: libaudit1 (>= 1:2.2.1), libc6 (>= 2.34), libpam0g (>= 0.99.7.1), libselinux1 (>= 3.1~), zlib1g (>= 1:1.2.0.2), libpam-modules Pre-Depends: init-system-helpers (>= 1.54~) Conflicts: sudo-ldap Conffiles: /etc/init.d/sudo 4fd40c92739a3bb2242df7cc6af126df /etc/pam.d/sudo 7fa5090826481c517f23faa1e21c77a8 /etc/pam.d/sudo-i 95199b1f3d5a60bcf98058d9f8b70e70 /etc/sudo.conf 8c714b777580faea54a2eb6d5f17ad1d /etc/sudo_logsrvd.conf ad0ba586da300ae3ba46312ad744a6e2 /etc/sudoers da8bee36494c904ba767f0dd58920878 /etc/sudoers.d/README 44c75ff004a18eeefdde4c998914d6d3 Description: Provide limited super user privileges to specific users Sudo is a program designed to allow a sysadmin to give limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow people to get their work done. . This version is built with minimal shared library dependencies, use the sudo-ldap package instead if you need LDAP support for sudoers. Homepage: https://www.sudo.ws/ This sudo version has a known vulnerability

CVE-2025-32463 Detail

```Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
```

So i looked into exploits for this vulnerability and found a script that exploits this vuln at https://www.exploit-db.com/exploits/52352

creating that script within the ssh shell elevated my shell to root@expressway

with that i navigated to the /root directory, and within that directory is a single file called root.txt, which was the second flag