HackTheBox - Helix
Source: YouTube · IppSec · published Aug 8, 2026 · 46:22
BLUF: This video demonstrates the exploitation of the Hack the Box machine "Helix," focusing on an ICS/SCADA environment. The attacker gains initial access via Remote Code Execution (RCE) in Apache NiFi, escalates privileges by manipulating a Programmable Logic Controller (PLC) via OPC UA to trigger a maintenance mode, and finally executes a command to obtain root access.
Key Takeaways:
• Initial reconnaissance revealed a subdomain flow.helix.htb hosting an Apache NiFi instance, which was identified as a flow-based data processing engine common in ICS systems 3:45.
• The attacker exploited a configuration flaw in the H2 database within NiFi to achieve Remote Code Execution (RCE) without needing a specific CVE, as code execution is a built-in feature of the interface 5:30.
• Post-exploitation file analysis revealed an SSH private key for the user "operator" and a password-protected PDF containing control system diagrams and credentials 28:30.
• The PDF password was cracked ("operatorone"), revealing that the system enters a maintenance mode allowing root access when temperature/pressure thresholds are met via the PLC 32:10.
• The attacker used an OPC UA client to connect to the PLC, changed the control mode to "maintenance," and increased the calibration offset to simulate high temperature, triggering the root shell script 42:00.
The exploitation highlights the risks of low-code ICS platforms where configuration errors can lead to direct system compromise. By manipulating physical process variables through the OPC interface, the attacker bypassed standard OS security controls to achieve privilege escalation.
Sources:
- 3:45 Discovery
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on YouTube? This is IPSC and today we'll be doing Helix from Hack the Box and the theme of this box is an ICS SCA system starting with Apache Niffy. This is a flow-based data processing engine which sounds complex but essentially it's just a drag and drop interface that enables operators to essentially program without any programming knowledge. This type of interface is common in the ICS world and exploitation is simple. Many people used a CVE but in reality code execution is a feature so you can just get a shell right away. Once on the box, you discover some PDFs that talk about a PLC, which is a programmable logic controller. And this monitors the temperature and pressure. When it hits a certain threshold, the system will go into maintenance mode, allowing root access. So, w…