Autopilot HTB Writeup

I just solved Autopilot from Hack the Box!

Autopilot Machine Summary

Autopilot is an insane-difficulty Windows machine on Hack The Box that focuses on web application enumeration, Server-Side Request Forgery (SSRF), Redis exploitation, Linux privilege escalation, NTLM authentication relay, credential recovery, reverse engineering, and Active Directory compromise.

The attack begins with Nmap enumeration, revealing HTTPS as the only externally exposed service. By examining the SSL certificate, I identified several virtual hostnames associated with the target, including grommunio.autopilot.htb. After configuring hostname resolution, I explored the Grommunio web application and its integrated Files application. Using the supplied credentials for deborah.hernandez, I gained access to both the mailbox and Files service. Further enumeration revealed that the Files application allowed users to configure their own Seafile backend, providing an opportunity to investigate its backend communication.

By configuring a controlled Seafile server and manipulating its API responses, I discovered a Server-Side Request Forgery (SSRF) vulnerability that allowed requests to internal services. I exploited this functionality using a specially crafted gopher:// URL to communicate with the locally running Redis instance. Further investigation revealed that the Nextcloud-derived Files application cached the location of the sendmail executable in Redis. By poisoning this cache entry with a Bash reverse shell command and triggering an email notification through a WebDAV file-sharing operation, I achieved my initial foothold as the grofiles user on the Grommunio server.

After obtaining the initial shell, I established a network pivot using Chisel to access internal services that were not externally exposed. Through the SOCKS proxy, I identified an internal PHP-FPM service and exploited its FastCGI interface to execute commands as wwwrun. Further investigation of the Grommunio Admin API revealed an insecure database-configuration mechanism that allowed modification of Postfix configuration settings and registration of a POSTCONF commit hook. By abusing this functionality, I manipulated the Postfix daemon directory and triggered a controlled script during a service restart, creating a setuid Bash executable. Executing this binary with preserved privileges provided root access to the Grommunio server, allowing me to locate and capture the user flag.

During post-exploitation, I shifted my attention to the internal Active Directory environment. Using the sa-joshua.harris service account, I authenticated to LDAP and SMB through the established network pivot and enumerated the domain's computer accounts. This revealed three important systems: DC01, the Windows Server 2025 domain controller; WS02, a Windows 11 workstation; and the compromised Grommunio server. Although further enumeration revealed that Joshua belonged to the DnsAdmins and System Administrators groups, attempts to exploit the DNS administration functionality did not provide a reliable privilege escalation path.

Further SMB enumeration revealed an important misconfiguration: DC01 required SMB signing, whereas WS02 did not. By establishing another Chisel reverse port forward, I exposed WS02's SMB service to my attacking machine. Monitoring network activity on the compromised mail server revealed that WS02 repeatedly connected to Grommunio over IMAP and authenticated using NTLM after negotiating STARTTLS. I exploited this recurring authentication behavior by temporarily replacing the IMAP listener, capturing the live NTLM authentication exchange, and relaying it to WS02's unsigned SMB service. The relay successfully authenticated as AUTOPILOT\stephanie.lewis, providing administrative access to the workstation's SMB shares.

With administrative access to WS02, I investigated Stephanie's Thunderbird profile and recovered the files logins.json and key4.db, which contained encrypted saved credentials and the associated encryption keys. Using Firepwd, I decrypted the stored Grommunio web and IMAP credentials. I subsequently validated the recovered password using NetExec, confirming that stephanie.lewis had local administrator privileges on WS02. Further enumeration also revealed local account hashes, the workstation machine-account secret, and Stephanie's cached DCC2 hash.

Finally, I investigated an unusual Go executable named runas.exe located in Stephanie's Videos directory. By examining the executable's metadata, Go symbols, and disassembled instructions, I discovered that it contained an embedded password protected using a repeating XOR operation. I extracted the ciphertext and encryption key from the binary's Go slice structures and reproduced the decryption routine using Python, successfully recovering the embedded Domain Administrator password associated with AUTOPILOT\da-stephanie.lewis.

Using the recovered credentials through the established SOCKS proxy, I authenticated to DC01 with Domain Administrator privileges. Although WMI execution encountered issues retrieving its output, I accessed the domain controller's administrative C$ share directly using smbclient and downloaded C:\Users\Administrator\Desktop\root.txt. This successfully provided the root flag, completing the machine.

Overall, Autopilot demonstrates how multiple security weaknesses across Linux web applications and Windows Active Directory environments can be chained together to achieve complete domain compromise. The attack progresses from an SSRF vulnerability and Redis poisoning to Linux root access, followed by NTLM relay, credential extraction, and reverse engineering to recover Domain Administrator credentials. The machine highlights the security risks associated with user-controlled backend integrations, insecure internal service configurations, insufficient SMB signing enforcement, reusable credentials stored in user profiles, and sensitive passwords embedded in executable files.