# HTB-Expressway ![image](https://hackmd.io/_uploads/HypAEI9Rge.png) This machine have only port 22, this look very strange. I scan with udp and have port 500 ![image](https://hackmd.io/_uploads/HJMXwLqAee.png) I search google and have [this link](https://book.hacktricks.wiki/en/network-services-pentesting/ipsec-ike-vpn-pentesting.html). It is show me about IPsec and how to pentest https://angelica.gitbook.io/hacktricks/network-services-pentesting/ipsec-ike-vpn-pentesting First i will scan for IPsec VPN Services. ![image](https://hackmd.io/_uploads/rkIUiUcCge.png) After scan i got some information: * IKE (Internet Key Exchange) service is active * XAUTH (Extended Authentication) support - usually uses username/password * Supports Dead Peer Detection v1.0 Let’s identify VPN Vendor & Configuration. ![image](https://hackmd.io/_uploads/SJE5s85Clx.png) I get the ike@expressway.htb and know the domain is expressway.htb.→ Add these to /etc/hosts I extract VPN Group Name & Hash but this one is PSK. ![image](https://hackmd.io/_uploads/BJjgCI5Rxl.png) I use psk-crack to crack the hash and i get the password for ike@expressway.htb:freakingrockstarontheroad ![image](https://hackmd.io/_uploads/rkqf1P5Cxe.png) I verified the cracked PSK by running `ike-scan --psk='freakingrockstarontheroad' 10.10.11.87` the gateway returned a Main Mode Handshake, confirming the PSK is valid. ![image](https://hackmd.io/_uploads/rJehgD5Axe.png) I ssh by account ike and get user flag ![image](https://hackmd.io/_uploads/rkcCev9Axe.png) There is no sudo permissions here. ike in group proxy so i check permission from proxy ![image](https://hackmd.io/_uploads/HJwPbv5Axg.png) Let’s check out /var/spool/squid. I found hostname internal offramp.expressway.htb blocked by proxy ![image](https://hackmd.io/_uploads/HJuhZDq0lx.png) I check sudo version and find the [CVE-2025-32462](https://www.exploit-db.com/exploits/52354) ![image](https://hackmd.io/_uploads/ryS6zw90xl.png) With the hostname offramp.expressway.htb and parameters -h i can have root permission ![image](https://hackmd.io/_uploads/rymZEP9Reg.png)