Writeups on Portfoliohttps://nosmas.me/writeups/Recent content in Writeups on PortfolioHugoen-us2026<link>https://nosmas.me/writeups/writeup/</link><pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate><guid>https://nosmas.me/writeups/writeup/</guid><description><p>HTB Expressway writeup</p> <p> </p> <p><strong>TLDR</strong></p> <p>IKE (IPsec) Aggressive mode leaked enough information to capture an authentication secret allowing SSH access as a local user. An outdated <code>sudo</code> then allowed privilege escalation to root with CVE-2025-32463.</p> <hr> <p> </p> <p><strong>Recon</strong></p> <p>Initial Nmap scan reveals nothing useful on TCP except SSH and basic information, but on UDP we see ISAKMP.</p> <p>Nmap scan report for 10.10.11.87<br> Host is up (0.025s latency).<br> Not shown: 65534 closed tcp ports (conn-refused)<br> PORT STATE SERVICE VERSION<br> 22/tcp open ssh OpenSSH 10.0p2 Debian 8 (protocol 2.0)<br> Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel</p></description></item></channel></rss>