HTB: Expressway

Fri, 20 Feb 2026 00:00:00 +0000

Expressway is the kind of machine that makes you second-guess your recon. You scan it, get one TCP port, and think you must have missed something. You didn’t. There’s no web app here, no API, no admin panel to poke at. Just SSH and a VPN service sitting on UDP that most people walk right past.

Recon

TCP scan first, as always.

nmap -sV -O MACHINE_IP -T5

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 10.0p2 Debian 8 (protocol 2.0)

One result: port 22, OpenSSH 10.0. That’s it. At this point you either assume the box is broken or you scan UDP.

Vpn on kanyo's blog

HTB: Expressway

Recon