Expressway
Linux Easy Box from HackTheBox Season 9 (1/13)
Reconnaissance
As always we start off with a TCP port scan using nmap
But we only see TCP Port 22 | SSH Open and if you're wondering, no, this is not a SSH 0day.
As TCP didn't show us much information, let's try and enumerate top 100 ports of the UDP protocol:
And now we see UDP Port 500 | isakmp open
In order to exploit this port we will be using the Hacktricks Cheatsheet
First off by scanning the version of IKE Running on the victim port
We see Dead Peer Detection v1.0 but it's not relevant for now
Exploiting 500/UDP with ike-scan
As HackTricks recommends, we can try and bruteforce the ID with ike-scan
Which we do with:
We successfully retrieved a hash!! Let's try and brute-force it with ikescan2john and afterwards with john
We retrieve the following password freakingrockstarontheroad which we are going to password spray with some users I have in mind:
And after password spraying, we have success with the ike account through SSH
Privilege Escalation
We start off by enumerating the groups we are in and if we got sudo capabilities
But we see this doesn't lead to anything, so let's enumerate interesting files with SUID capabilities and misconfigured cron jobs
But nothing interesting here neither, let's enumerate the sudo version
After researching in google, we see that this is vulnerable to CVE-2025-32463 with the following exploit:
We run the exploit...
And we successfully got root!!
Last updated