https://bokkapig.pages.dev/tags/runscript/Recent content in RUNSCRIPT on bokkapigHugoen-gbSat, 09 May 2026 00:00:00 +0000https://bokkapig.pages.dev/writeups/helix/Sat, 09 May 2026 00:00:00 +0000https://bokkapig.pages.dev/writeups/helix/The vhost flow.helix.htb proxies an Apache NiFi 1.21.0 canvas that runs completely unauthenticated — GET /nifi-api/flow/current-user returns anonymous with every permission true — so CVE-2023-34468 (NiFi 0.0.2–1.21.0, fixed 1.22.0, CVSS 8.8) is reachable cold: a DBCPConnectionPool pointed at an H2 in-memory JDBC URL plus an ExecuteSQL processor running RUNSCRIPT FROM ‘http://attacker/rce.sql’ executes H2’s CREATE ALIAS Java stored procedure and returns a shell as nifi. A forgotten support bundle leaves operator’s OpenSSH ed25519 key world-readable at /opt/nifi-1.21.0/support-bundles/operator_id_ed25519.bak, giving user.txt. Root is an ICS safety-interlock abuse: operator may sudo /usr/local/sbin/helix-maint-console, which only checks that /opt/helix/state/maintenance_window holds a future timestamp before exec’ing bash -p, and the root helix-safety controller writes that file when the reactor enters a hazardous test band. The loopback-only OPC UA PLC on 127.0.0.1:4840 accepts anonymous writes, so setting Mode=MAINTENANCE, TestOverride=True and slowly ramping CalibrationOffset until Temperature crosses 295 °C — without hitting the 305 °C trip — makes root open the window itself.