HTB Expressway writeup TLDR IKE (IPsec) Aggressive mode leaked enough information to capture an authentication secret allowing SSH access as a local user. An outdated sudo then allowed privilege escalation to root with CVE-2025-32463. Recon Initial Nmap scan reveals nothing useful on TCP except SSH and basic information, but on UDP we see ISAKMP. Nmap scan report for 10.10.11.87 Host is up (0.025s latency). Not shown: 65534 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 10.0p2 Debian 8 (protocol 2.0) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel ...
Writeups
HackTheBox machines, challenges and Sherlocks. Only retired content is published.