> ## Content Index > Fetch the complete content index at: https://community.lesion.io/llms.txt > Use this file to discover other available public pages before exploring further. # Expressway Walkthrough - HTB Easy box - URL: https://community.lesion.io/expressway-walkthrough-htb-easy-box/ - Published: 2026-01-30T16:45:23.000Z - Updated: 2026-01-30T16:45:23.000Z - Author: sidonpc - Tags: HackTheBox Rooms, Walkthroughs # Enumeration We first start with our nmap scan of the machine. ![](https://storage.ghost.io/c/96/a1/96a15c67-4258-492c-96e7-7320df544bc9/content/images/2025/09/image-34.png) Initial nmap scan. Its here that we notice only port 22 being open on the TCP side. So I scan the UDP ports and identify port 500 IKE being open. IPSEC / IKE VPN is what is running on this port so I do a little more enumeration with nmap. ![](https://storage.ghost.io/c/96/a1/96a15c67-4258-492c-96e7-7320df544bc9/content/images/2025/09/image-35.png) Enumeration nmap scan Its not a ton of information so I break out ike-scan and begin following the information I found in these 2 articles. [500/udp - Pentesting IPsec/IKE VPN - HackTricks![](https://storage.ghost.io/c/96/a1/96a15c67-4258-492c-96e7-7320df544bc9/content/images/icon/favicon.svg)HackTricks![](https://storage.ghost.io/c/96/a1/96a15c67-4258-492c-96e7-7320df544bc9/content/images/thumbnail/arte.png)](https://book.hacktricks.wiki/en/network-services-pentesting/ipsec-ike-vpn-pentesting.html?highlight=ISAK&ref=community.lesion.io#discover--the-service-using-nmap) [IPsec/IKE VPN - Port 500/UDP | VeryLazyTech![](https://storage.ghost.io/c/96/a1/96a15c67-4258-492c-96e7-7320df544bc9/content/images/icon/icon)VeryLazyTech![](https://storage.ghost.io/c/96/a1/96a15c67-4258-492c-96e7-7320df544bc9/content/images/thumbnail/image)](https://www.verylazytech.com/network-pentesting/ipsec-ike-vpn-port-500-udp?ref=community.lesion.io) Hacktricks gave me some really good information on the in's and out's of the IKE protocol and some things to look for. For instance we see here the user "ike". ![](https://storage.ghost.io/c/96/a1/96a15c67-4258-492c-96e7-7320df544bc9/content/images/2025/12/image-38.png) Using ike-scan to enumerate port 500\. We find a username. The iker.py tool also gave some pretty good information at a quick glance. ![](https://storage.ghost.io/c/96/a1/96a15c67-4258-492c-96e7-7320df544bc9/content/images/2025/09/image-36.png) Playing around with iker.py and other ike enumeration tools/scripts. # Initial Access The big help was the second article by VeryLazyTech. He writes that we can run the following command to return a hash that can be cracked. ```bash ike-scan -A --pskcrack 10.10.10.87 ``` Because aggressive mode is enabled we can grab the hash. ![](https://storage.ghost.io/c/96/a1/96a15c67-4258-492c-96e7-7320df544bc9/content/images/2025/09/image-37-1.png) Obtaining the hash for the ike@expressway.htb user. I put the hash into a file and used the tool psk-crack to crack that hash. This gives us the password to the ike user that we identified previously. With this information we can login via SSH. ![](https://storage.ghost.io/c/96/a1/96a15c67-4258-492c-96e7-7320df544bc9/content/images/2025/09/image-39-1.png) Cracking the hash with psk-crack ![](https://storage.ghost.io/c/96/a1/96a15c67-4258-492c-96e7-7320df544bc9/content/images/2025/09/image-43.png) ssh as the ike user. # Escalate Privileges To start I looked to see what I can run as sudo. ![](https://storage.ghost.io/c/96/a1/96a15c67-4258-492c-96e7-7320df544bc9/content/images/2025/09/image-40.png) Not able to run anything as sudo Ike cant run sudo so I next check my sudo version. ![](https://storage.ghost.io/c/96/a1/96a15c67-4258-492c-96e7-7320df544bc9/content/images/2025/09/image-41.png) Identifying vulnerable sudo version Researching this sudo version we find 2 different privilege escalation exploits for this version of sudo. They were both released in 2025\. [Sudo 1.9.17 Host Option - Elevation of PrivilegeSudo 1.9.17 Host Option - Elevation of Privilege. CVE-2025-32462 . local exploit for Linux platform![](https://storage.ghost.io/c/96/a1/96a15c67-4258-492c-96e7-7320df544bc9/content/images/icon/favicon-2.ico)Exploit DatabaseRich Mirch![](https://storage.ghost.io/c/96/a1/96a15c67-4258-492c-96e7-7320df544bc9/content/images/thumbnail/spider-orange-1.png)](https://www.exploit-db.com/exploits/52354?ref=community.lesion.io) [Sudo chroot 1.9.17 - Local Privilege EscalationSudo chroot 1.9.17 - Local Privilege Escalation. CVE-2025-32463 . local exploit for Linux platform![](https://storage.ghost.io/c/96/a1/96a15c67-4258-492c-96e7-7320df544bc9/content/images/icon/favicon-1.ico)Exploit DatabaseStratascale![](https://storage.ghost.io/c/96/a1/96a15c67-4258-492c-96e7-7320df544bc9/content/images/thumbnail/spider-orange.png)](https://www.exploit-db.com/exploits/52352?ref=community.lesion.io) I first tried the "Host Option" exploit and it didn't do much for me. I next tried the "sudo chroot" exploit and that one ended up working for me. Following the exploits instructions we obtain a root shell. ![](https://storage.ghost.io/c/96/a1/96a15c67-4258-492c-96e7-7320df544bc9/content/images/2025/09/image-42-1.png) Running the Sudo chroot 1.9.17 exploit Overall this was a super fun machine. Working with the IKE protocol and a new 2025 CVE was super slick. No crazy out of pocket exploits needed very straightforward and with research anyone should be able to exploit. Thank you @[dakkmaddy](https://app.hackthebox.com/users/17571?ref=community.lesion.io) for the box! \--Hive0x09