Layover

hackthebox

Task: HTB Linux machine 'Layover' with RDP-only access, a simulated internal Wi-Fi network, Craft CMS, and a local CUPS service. Solution: RDP in, capture cleartext portal credentials off the hwsim wireless, exploit Craft CMS Yii behavior injection (CVE-2026-44011) for RCE, decrypt DB secrets, reuse the mail-relay password over SSH, then abuse CUPS (CVE-2026-34990) to write a sudoers drop-in and get root.