Orion is a Linux box running a Craft CMS website. I’ll exploit an unauthenticated remote code execution vulnerability in Craft’s image transform endpoint, abusing an object injection flaw in the underlying Yii framework to poison a PHP session file and execute my payload, landing a shell as the web user. Reading the Craft configuration, I’ll find database credentials, dump the users table, and crack a bcrypt hash to reach the next user, though that step turns out to be optional. For root, I’ll find inetd serving telnet, and abuse an authentication bypass that provides access as root by smuggling a “-f root” value through the USER environment variable.

0xdf hacks stuff

A detailed walkthrough of the HackTheBox machine 'Orion', a Linux box running Craft CMS 5.6.16. The exploit chain starts with CVE-2025-32432, an unauthenticated RCE in Craft's image transform endpoint that abuses an object injection flaw in the Yii2 framework. By poisoning a PHP session file with a crafted URL parameter and using the PhpManager gadget to execute it, a shell is obtained as www-data. Database credentials from the .env file lead to a bcrypt hash crack (password: darkangel) for lateral movement to user 'adam'. Root access is achieved by abusing inetd-served telnet's authentication bypass, smuggling '-f root' through the USER environment variable.

HTB: Orion