Skip to main content

Posts

HTB Autopilot - Full Writeup (Insane Windows, Season 12)

October 23, 2026 12 min read Insane Windows / AD HackTheBox Season 12 Grommunio Domain Admin Attack chain Grommunio → Seafile SSRF → Redis Poison → grofiles RCE → PHP-FPM → Postfix root → Chisel pivot → NTLM relay → firepwd → XOR runas → Domain Admin HTB Autopilot is an Insane-rated Windows Active Directory machine from HackTheBox Season 12. The attack chain starts with a Grommunio mail server, abuses a Seafile plugin SSRF to poison a Redis cache, achieves RCE via a sendmail hook, pivots into the internal AD environment, and ends with a Domain Admin shell via NTLM relay. Want more detailed walkthroughs, writeups, and cybersecurity content? Download CyberMaster App Buy Me a Coffee Table of Contents Reconnaissance: nmap and subdomain discovery Grommunio Files Plugin to Seafile SSRF setup Redis cache poisoning via gopher SSRF RCE trigger, shell as grofiles Lateral movement via PHP-FPM FastCGI Privilege escalation via Postfix hook Pivoting with Chis...
Post a Comment
Read more
Recent posts

HackTheBox Support (Easy) Walkthrough

Support is an Easy rated Windows Active Directory box that packs a surprising amount of learning into a short chain. It starts with an open SMB share, moves through decompiling a .NET binary, decrypts a hardcoded credential, hunts LDAP attributes for a plaintext password, and finishes with a Resource Based Constrained Delegation attack that impersonates the Domain Administrator. For the complete step by step exploitation guide with every command and screenshot, grab the CyberMaster Android app or visit my Buy Me a Coffee page. Machine Overview Field Detail Name Support OS Windows Server 2022 Difficulty Easy Platform HackTheBox Services DNS, Kerberos, RPC, LDAP, SMB, WinRM Domain support.htb What Makes Support Interesting Support is a great introduction to Active Directory attack paths for anyone moving from Linux to Windows boxes. It teaches: SMB guest access...
Post a Comment
Read more

Eloquia (Insane) HackTheBox Walkthrough

  Eloquia (Insane) HackTheBox Walkthrough Eloquia is one of those boxes that reminds you why "Insane" difficulty exists. It is not a single clever trick. It is a chain of vulnerabilities where each one depends on the previous step. Miss a link, and you are stuck for hours. This post covers what the machine is about and the concepts it teaches, without walking through every keystroke. For the complete step by step exploitation guide with every command, payload, and screenshot, grab the CyberMaster Android app or visit my Buy Me a Coffee page. Machine Overview Field Detail Name Eloquia OS Windows Server 2019 Difficulty Insane Platform HackTheBox Services IIS 10.0 (HTTP), WinRM (5985) AD Standalone Windows Server, no AD What Makes Eloquia Interesting Eloquia is a modern enterprise simulation. It runs a custom Django blogging platform at eloquia.htb with ...
Post a Comment
Read more

HTB : First Contact Writeup

This challenge is highly unique because it bypasses standard application bugs or privilege escalation vectors. Instead, it places you directly inside the virtual shoes of a ground station operator, requiring a clean mix of raw network script interaction and astronomical dataset propagation . The Anatomy of the Challenge Input When connecting to the live instance socket, you are instantly handed two distinct elements: Ground Station Telemetry: Precise floating point geographic variables representing the exact Latitude, Longitude, and elevation of a tracking array. Two-Line Element (TLE) Set: The industry standard data format mapping out the specific orbital elements of the target spacecraft, including inclination, eccentricity, and argument of perigee at a fixed point in time. The Technical Hurdle: Time W...
Post a Comment
Read more

HTB Touch - Full Writeup (Easy Windows, Season 12)

Buy Me a Coffee Enjoying the writeup? Support the work. Season 12, Easy Windows. Finished it in an evening. Learned more than I expected. I finished the Touch machine on Hack The Box last night. It is rated Easy, and honestly, it earns that rating. There is no memory corruption, no exotic bug, no clever bypass that makes you feel like a wizard. What it has instead is a chain of small, believable mistakes that stack on top of each other until you are sitting on a SYSTEM shell wondering how you got there. That is why I wanted to write about it. Not because the box is hard, but because it is real. The Setup Touch is a Windows box themed around an airport. It picks up a thread from the earlier Layover machine, where you uncover a passenger name and a booking reference that you then reuse here. That small continuity detail is a nice touch, and it mirrors how real attackers actually operate. They rare...
Post a Comment
Read more

Garfield (Hard, Active Directory) Walkthrough

Garfield is one of those rare HackTheBox machines where nothing is exploited with a CVE or a public proof of concept. Every step is a Microsoft documented Active Directory feature being abused exactly the way it was designed. That is what makes it a great box for anyone who wants to understand how real world Active Directory compromises actually look. The chain runs across seven distinct AD primitives, from a writable SYSVOL share to a forged Kerberos ticket against a Read Only Domain Controller. This post walks through the concepts behind each stage without dumping flags or hand holding every command. Why Garfield Is Interesting Most Active Directory boxes stop at Domain Admin. Garfield takes a different route. The writable Domain Controller on this box is a Read Only Domain Controller (RODC), and the RODC sits on a separate subnet that is not directly reachable from the attacker. That means the ch...
Post a Comment
Read more

HTB Layover Discussion: From Open WiFi to Root

Layover is a Hack The Box Season 12 machine that rewards patience and careful enumeration. No single step in the chain is exotic. What makes it interesting is that each discovery depends on the previous one, and the overall path moves across three very different domains: wireless networking, web application security, and local Linux privilege escalation. This post is a discussion of the attack chain and the underlying weaknesses. Command-level detail and full reproduction steps are reserved for the detailed writeup, available through the link at the end of this post. Buy me a coffee Detailed writeup for supporters Overview of the Chain The compromise begins with access to a wireless-capable jump host. From that position, an internal wireless network is visible, and it is configured without any layer-2 encryption. A login submitted over plain HTTP o...
Post a Comment
Read more

PingPong HTB Insane — Two Domain AD Forest Takeover

Overview: PingPong starts with a single low privileged account (c.roberts) in the PING.HTB domain and ends with full control of the forest. NTLM is disabled everywhere, so every step must run over Kerberos. The chain moves through ADCS abuse on PING, cross domain gMSA abuse into PONG, resource based constrained delegation and MSSQL for local admin on DC2, and finally back to PING via a CA Managers cross domain group to rewrite a certificate template (ESC4 to ESC1) and impersonate Administrator. Nmap The target is a Windows Domain Controller. Ports 53, 88, 135, 139, 389, 445, 464, 593, 636, 3268, 3269, and 5985 are open. The LDAP certificate SAN confirms the domain is ping.htb with hostname dc1.ping.htb . nmap -sC -sV -Pn <DC1_IP> -oN ./nmap.txt Add the hostname to /etc/hosts . The provided credentials are c.roberts / AssumedBreach123 . Information Gathering from DC1 SMB and LDAP both reject the supplied credentials with STATUS_NOT_SUPPORTED . That ...
Post a Comment
Read more