HackTheBox - ExpressWay

Why It Matters

It highlights how neglected UDP services and legacy software can grant attackers full control, emphasizing urgent patch management and comprehensive scanning in modern security practices.

Key Takeaways

• UDP scan reveals open IKE port 500 for exploitation
• Aggressive IKE mode yields hash cracked to obtain SSH credentials
• TFTP enumeration exposes Cisco router.cfg revealing IKE username
• Outdated Pseudo 1.9.17 vulnerable to two privilege escalation exploits
• Exploiting Pseudo host option grants root without password

Summary

The video walks through the Hack The Box "ExpressWay" machine, illustrating how a seemingly simple box can be compromised by leveraging old, overlooked vulnerabilities. The presenter starts with a UDP Nmap scan, discovers the IKE service on port 500, and uses aggressive mode to extract a hash that is later cracked with Hashcat, yielding the SSH credentials for the user "ike". Key insights include the challenges of UDP scanning, the value of aggressive IKE handshakes for credential harvesting, and the discovery of an exposed TFTP server that contains a Cisco router configuration file. The config file confirms the username "ike" and hints at the IKE pre‑shared key, while the SSH login reveals a vulnerable version of the "pseudo" daemon (1.9.17), which is susceptible to two separate privilege‑escalation bugs. Notable moments feature the line "IKE at expressway.htb" that guides the username guess, the use of the "pseudo -R" exploit script that drops the attacker directly to a root shell, and a detailed explanation of the pseudo host‑option flaw that allows impersonation of another host to bypass intended restrictions. The demonstration underscores the importance of scanning UDP services, revisiting legacy exploits, and hardening misconfigured daemons. For penetration testers and defenders alike, the case shows how quickly an outdated utility can provide a full system compromise, reinforcing the need for timely patching and thorough service enumeration.

Original Description

00:00 - Introduction

00:40 - Start of nmap

03:30 - UDP Nmap finished, running ike-scan in aggressive mode

05:00 - Cracking the ike hash with hashcat and then SSH into the box

06:10 - Showing TFTP was open which has a cisco config, showing MSF and NMAP to enumerate the TFTP Service

10:55 - Running LinPeas to show us the outdated sudo

12:00 - Exploiting CVE-2025-32463, the CHROOT Sudo Exploit

14:30 - Exploiting the other one, CVE-2025-32462, which requires finding a hostname on the box