Orion: Craft CMS RCE to Root (Walkthrough)

Orion is an Ubuntu 22.04.5 Hack The Box machine themed around a small telecom company. The site lives at orion.htb, running Craft CMS 5.6.16 behind nginx, with SSH open and not much else. It’s a web-focused box: the app is where the story starts, and most of the interesting bits come from how it’s configured. I’ll walk through the whole thing: reconnaissance, the initial foothold, and the path to root, including the parts that didn’t go smoothly. If you’re following along, you just need the target IP and an /etc/hosts entry.