Expressway - Hack The Box Machine

Septmeber 2025

User Flag

nmap -sS -sV -sU -P -p1-1000 10.10.11.87

Nmap scan report for 10.10.11.87
Host is up (0.049s latency).
Not shown: 1995 closed ports
PORT    STATE         SERVICE VERSION
22/tcp  open          ssh     OpenSSH 10.0p2 Debian 8 (protocol 2.0)
68/udp  open|filtered dhcpc
69/udp  open|filtered tftp
500/udp open          isakmp?
650/udp open|filtered bwnfs
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 1198.08 seconds

ike-scan -M 10.10.11.87

Starting ike-scan 1.9.6 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
10.10.11.87	Main Mode Handshake returned
	HDR=(CKY-R=89dac9ffa98e2f65)
	SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800)
	VID=09002689dfd6b712 (XAUTH)
	VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)

Ending ike-scan 1.9.6: 1 hosts scanned in 0.063 seconds (15.79 hosts/sec).  1 returned handshake; 0 returned notify