~/home ./writeups ./bounties ./membership ./digest ./news ./about ./contact

~/home ./writeups ./membership ./digest ./news ./bounties ./about ./contact

Orion - HTB Machine Writeup

Difficulty: Easy | OS: Linux | Status: Completed

A detailed walkthrough of the Hack The Box "Orion" machine, covering Craft CMS fingerprinting, exploitation of CVE-2025-32432 (a pre-authentication RCE in Craft CMS's asset transform handling), extraction of database credentials from a `.env` file, bcrypt hash cracking with Hashcat, SSH access, and root privilege escalation via a `USER` environment-variable argument-injection flaw in a local Telnet service.

Tags: craft-cms, cve-2025-32432, telnet-privesc

[ LOADING MACHINE DATA... ]

_

ONLINE

Privacy Policy Terms of Service

© 2025–2026 0xJerry. All rights reserved.

|Built in the shadows///

Orion - HTB Writeup | 0xJerry's Lab