I just solved Helix from Hack the Box
Helix Machine Summary
Helix is a medium difficulty Linux machine on Hack The Box that focuses on modern industrial control system exploitation, combining web enumeration, Apache NiFi abuse, credential harvesting, SSH pivoting, OPC UA manipulation, and privilege escalation through an industrial maintenance console. The machine demonstrates how insecure industrial automation environments and exposed management platforms can be chained together to achieve full system compromise.
The attack chain started with Nmap enumeration, which revealed SSH running on port 22 and an HTTP service hosted on port 80. After performing host configuration by updating the /etc/hosts file, the helix.htb domain became accessible. Initial web enumeration exposed a professional industrial automation portal for Helix Industries, but no obvious attack surface was immediately visible, prompting deeper enumeration efforts.
During subdomain enumeration using virtual host fuzzing, a new subdomain named flow.helix.htb was discovered. Accessing the subdomain revealed an Apache NiFi instance used for industrial data flow automation and process orchestration. Further Apache NiFi enumeration through the interface’s About section identified the application as running Apache NiFi version 1.21.0.
Version-based vulnerability research led to the discovery of CVE-2023-34468, a known remote code execution vulnerability affecting vulnerable Apache NiFi deployments through abuse of the embedded H2 database functionality. After preparing the public proof-of-concept exploit and configuring a Netcat listener, the vulnerability was successfully exploited to achieve initial access as the nifi user through Apache NiFi remote code execution.
Once access was obtained, post-exploitation enumeration of the NiFi installation directories revealed a support-bundles folder containing a backup SSH private key file named operator_id_ed25519.bak. During credential enumeration, the exposed OpenSSH private key was extracted and prepared locally by creating an id_rsa file and applying proper file permissions. The recovered key allowed successful SSH authentication as the operator user, leading to stable shell access and capture of the user flag.
Privilege escalation enumeration revealed that the operator user could execute a custom binary named /usr/local/sbin/helix-maint-console with sudo privileges and without requiring a password. Further internal service enumeration identified multiple services listening exclusively on localhost, including ports 8080, 8081, and 4840. To investigate the restricted services, SSH port forwarding was configured to expose the internal application running on port 8081 to the attacker machine.
Internal web application enumeration of the forwarded service exposed a Reactor HMI industrial monitoring dashboard displaying operational reactor controls and references to an internal OPC UA service listening on 127.0.0.1:4840. Further sudo privilege enumeration and maintenance console testing revealed that privileged access depended on a specific “maintenance window” condition tied to the industrial control environment.
To manipulate the reactor state, OPC UA tooling setup was performed by creating a Python virtual environment and installing the opcua package. Using the uawrite utility, several OPC UA nodes were modified during OPC UA manipulation, including switching the reactor mode to MAINTENANCE, enabling maintenance override flags, and adjusting reactor calibration values. The OPC UA server accepted unauthenticated write requests, allowing direct modification of critical industrial control values.
After modifying the reactor state, the maintenance console was executed again and successfully granted privileged maintenance access. This resulted in full root privilege escalation and an interactive root shell on the target system. Finally, navigating to the root user’s home directory allowed retrieval of the root flag, completing the machine.
Overall, Helix is an excellent machine that demonstrates the dangers of insecure industrial control systems, exposed automation infrastructure, and weak operational security practices. The challenge effectively combines Apache NiFi exploitation, SSH credential exposure, OPC UA protocol abuse, industrial HMI interaction, SSH tunneling, and maintenance console privilege escalation into a realistic operational technology attack chain.
Protected Page
d
e
f
g
h
i
j
k
l
m
n
o
p
f
Keywords
HTB Writeup - Helix
Helix-HTB
Helix Writeup - HackTheBox
Helix | HTB Writeups
Mastering Helix: Beginner's Guide from Hack The Box
Helix Walkthrough - HackTheBox
helix.htb
HTB: Helix Writeup
HTB-Helix WriteUp
HTB Writeup - Helix
Apache NiFi 1.21.0 instance
flow.helix.htb:8080/nifi
htb-writeups Helix
Hack The Box - HTB Helix Writeup
Owned Helix from Hack The Box!
I just solved Helix on Hack The Box!
helix.htb walkthrough
0 Comments