Expressway – HTB Seasonal (Teaser)

Status: ✅ Completed
Platform: Hack The Box – Season 9 (Easy • Linux)
Write-up: Redacted until/unless HTB allows public solutions.

🧭 Overview

VPN-first box with a twist: Aggressive Mode IKE on UDP/500 gives you just enough to move from recon to a real foothold. From there, privilege escalation hinges on reading the environment—not just running an off‑the‑shelf script.

🧪 What I Can Share (No Spoilers)

• Recon: UDP/500 (ISAKMP/IKE) + NAT‑T exposed; Aggressive Mode handshake is capturable.
• Foothold: IKE Aggressive Mode → PSK capture → crack → valid user identified as ike → SSH in.
• Privesc: Sudo nuance rather than kernel tricks; a hostname hint in logs unlocks root with a clean, single‑line command.

If you’re practicing real‑world pace and restraint, this one rewards careful reads over noise.

🧠 Takeaways

• Don’t skip UDP. IKE on 500/udp often pays off.
• When enum tools are quiet, scan the logs and config for environment‑specific breadcrumbs.
• Quote carefully and prefer built‑in tools (ssh, sudo) for a low‑noise finish.

🖼️ Proofs

Expressway: pwned.

🔗 Links

• HTB machine page: https://app.hackthebox.com/machines/Expressway

📌 Notes

No flags or credential values are published here by design. Full write-up lives in a private repo until/unless HTB permits public solutions.