HackTheBox - ExpressWay
Source: YouTube · IppSec · published Mar 7, 2026 · 19:24
This video demonstrates a Hack The Box challenge called "Expressway," focusing on UDP enumeration to discover an IKE service, cracking obtained hashes for initial SSH access, and exploiting an outdated Sudo version for root 0:00-0:38.
Key Takeaways:
• The machine requires a UDP Nmap scan initially, as the primary attack vector relies on a UDP service rather than standard TCP ports 0:09-0:13.
• Running ike-scan in aggressive mode against port 500 exposes both a username and a password hash, which can be cracked to gain SSH access 0:16-0:24.
• An alternative path involves using TFTP to download Cisco configuration files if the IKE username is not immediately recognized 0:24-0:30.
• Privilege escalation is achieved by exploiting two known vulnerabilities in an outdated version of Sudo to obtain root access 0:32-0:38.
Overall, Expressway is a straightforward box that effectively tests a hacker's ability to enumerate UDP services and leverage legacy vulnerabilities for both initial access and root.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on YouTube? This is Ippsec, and today we'll be doing Expressway from Hack The Box, which is a pretty simple box, but does feature some old exploits and starts off with UDP, so you may not get it, at least right away. Once you run the Nmap scan with UDP, you'll discover that port 500 is open, which is IKE, and running IKE scan with aggressive mode gives us both a username and password hash, and we can crack that hash and let's us SSH into the box. If we didn't realize IKE was also the username, TFTP is running, and we can find some Cisco configs, which will show this. Once we get on the box, we'll discover that sudo is running an outdated version and is vulnerable to two different priv escs. Running either of those gets us root, so let's just jump in. As always, I'm going to st…