Orion — HTB Writeup | The Hack Sparrow

Executive summary — Orion is an Easy Linux box serving the "Orion Telecom" corporate site on Craft CMS 2.0.51. The foothold is a pre-authentication RCE (CVE-2025-32432) that lands a www-data shell; from there we read the application's .env, which stores cleartext MySQL credentials. Inside the database we steal the admin's bcrypt hash, crack it with hashcat and rockyou, and reuse that same password to log in over SSH as the system user adam. Escalation to root exploits an authentication flaw more than a decade old in the local Telnet service from GNU Inetutils (CVE-2026-24061). Path: Craft RCE -> .env -> MySQL -> hashcat -> SSH -> local Telnet -> root.

Platform	Hack The Box
Operating system	Linux (Ubuntu 22.04.5 LTS)
Difficulty	Easy
Status	Retired
Target IP	`10.129.244.146`

Attack map

[80] Craft CMS 2.0.51 -> CVE-2025-32432 (pre-auth RCE) -> www-data shell
   |  .env in /html/craft with cleartext MySQL credentials
   v
[MySQL]  users table -> admin bcrypt hash -> hashcat + rockyou -> darkangel
   |  password reuse with user adam
   v
[SSH]  adam  (user.txt)
   |  ss -tulnp -> Telnet only on 127.0.0.1:23 -> CVE-2026-24061
   v
[ROOT]  (root.txt)

1. Reconnaissance

Host discovery and a full port scan, UDP included:

netdiscover -i tun0 -P
arp-scan -I tun0 --localnet

nmap -p- --min-rate=2000 -T4 -Pn 10.129.244.146
nmap -sC -sV -p 22,80 -Pn 10.129.244.146
nmap -sU --top-ports 100 -T4 -Pn 10.129.244.146

Port	Service	Version
22/tcp	SSH	OpenSSH 8.9p1 Ubuntu 3ubuntu0.15
80/tcp	HTTP	nginx 1.18.0 (Ubuntu)

No open UDP ports show up in the top 100. Web enumeration:

whatweb -a 3 http://10.129.244.146
nikto -h http://10.129.244.146
feroxbuster -u http://10.129.244.146 -w /usr/share/wordlists/dirb/common.txt

whatweb returns a 302 to http://orion.htb/: the real site is served by vhost name, not by the bare IP. First hint not to write off a site just because the IP alone looks empty.

echo "10.129.244.146 orion.htb" | sudo tee -a /etc/hosts

Browsing to orion.htb shows the "Orion Telecom" site, with a contact form (Name, Email, Message).

Resumen ejecutivo — Orion es un Linux Easy que sirve la web corporativa de "Orion Telecom" sobre Craft CMS 2.0.51. El foothold es un RCE pre-autenticacion (CVE-2025-32432) que da una shell como www-data; desde ahi leemos el .env de la aplicacion, que guarda las credenciales de MySQL en texto claro. Dentro de la base de datos robamos el hash bcrypt del admin, lo crackeamos con hashcat y rockyou, y reutilizamos esa misma contraseña para entrar por SSH como el usuario del sistema adam. La escalada a root explota una vulnerabilidad de autenticacion de mas de una decada de antigüedad en el Telnet local de GNU Inetutils (CVE-2026-24061). Recorrido Craft RCE -> .env -> MySQL -> hashcat -> SSH -> Telnet local -> root.

Plataforma	Hack The Box
Sistema operativo	Linux (Ubuntu 22.04.5 LTS)
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.244.146`

Mapa del ataque

[80] Craft CMS 2.0.51 -> CVE-2025-32432 (RCE pre-auth) -> shell www-data
   |  .env en /html/craft con credenciales de MySQL en texto claro
   v
[MySQL]  tabla users -> hash bcrypt del admin -> hashcat + rockyou -> darkangel
   |  reutilizacion de la password con el usuario adam
   v
[SSH]  adam  (user.txt)
   |  ss -tulnp -> Telnet solo en 127.0.0.1:23 -> CVE-2026-24061
   v
[ROOT]  (root.txt)

1. Reconocimiento

Descubrimiento de host y escaneo de puertos completo, incluyendo UDP:

netdiscover -i tun0 -P
arp-scan -I tun0 --localnet

nmap -p- --min-rate=2000 -T4 -Pn 10.129.244.146
nmap -sC -sV -p 22,80 -Pn 10.129.244.146
nmap -sU --top-ports 100 -T4 -Pn 10.129.244.146

Puerto	Servicio	Version
22/tcp	SSH	OpenSSH 8.9p1 Ubuntu 3ubuntu0.15
80/tcp	HTTP	nginx 1.18.0 (Ubuntu)

No se detectan puertos UDP abiertos en el top 100. Enumeracion web:

whatweb -a 3 http://10.129.244.146
nikto -h http://10.129.244.146
feroxbuster -u http://10.129.244.146 -w /usr/share/wordlists/dirb/common.txt

whatweb devuelve un 302 hacia http://orion.htb/: el sitio real se sirve por nombre de vhost, no por IP directa. Es el primer aviso a no descartar la web solo por lo que se vea al pedir la IP a pelo.

echo "10.129.244.146 orion.htb" | sudo tee -a /etc/hosts

Al navegar a orion.htb aparece la web de "Orion Telecom", con un formulario de contacto (Name, Email, Message).

🔒 Free account required

This is USER ACCESS content — free to unlock, no payment. The rest of the write-up (and everything else at this level) opens up once you're signed in.

Create a free account