---
title: "HTB: Orion"
url: https://daily.dev/posts/htb-orion-p1pnwvkbh
source_url: https://0xdf.gitlab.io/2026/07/14/htb-orion.html
type: article
source: "0xdf hacks stuff"
published: 2026-07-14T15:14:40.704Z
updated: 2026-07-14T15:15:06.936Z
tags: ["security", "php"]
reading_time: 42
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# HTB: Orion

**[0xdf hacks stuff](https://daily.dev/sources/0xdf)** · 42 min read · 0 upvotes · 0 comments

## Summary

A detailed walkthrough of the HackTheBox machine 'Orion', a Linux box running Craft CMS 5.6.16. The exploit chain starts with CVE-2025-32432, an unauthenticated RCE in Craft's image transform endpoint that abuses an object injection flaw in the Yii2 framework. By poisoning a PHP session file with a crafted URL parameter and using the PhpManager gadget to execute it, a shell is obtained as www-data. Database credentials from the .env file lead to a bcrypt hash crack (password: darkangel) for lateral movement to user 'adam'. Root access is achieved by abusing inetd-served telnet's authentication bypass, smuggling '-f root' through the USER environment variable.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://0xdf.gitlab.io/2026/07/14/htb-orion.html>

## Similar posts on daily.dev

- [HTB: Guardian](https://daily.dev/posts/htb-guardian-tkykgwaky) · 0xdf hacks stuff · 1 upvotes · 0 comments
- [HTB: Era](https://daily.dev/posts/htb-era-imytcy2o7) · 0xdf hacks stuff · 1 upvotes · 0 comments
- [HackTheBox Writeup \(Walkthrough\)](https://daily.dev/posts/hackthebox-writeup-walkthrough--yi0kszlkw) · InfoSec Write-ups · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#php](https://daily.dev/tags/php)

[View this post on daily.dev](https://daily.dev/posts/htb-orion-p1pnwvkbh)