Source: Ippsec

HackTheBox - Helix

By Ippsec1 min readAugust 8, 2026

Internal Read means the full piece stays on Qubicweb, with its source path and context still visible.

Brief points

00:00 - Introduction 00:45 - Start of nmap 03:20 - Using FFUF to VHOST Bruteforce and finding flow.helix.htb 05:30 - Looking into H2 Database RCE's, finding the Alias Command al...
26:00 - Shell on the box, using Find to show the types of all the files in our CWD and finding an SSH Key 30:15 - Shell as Operator, cracking a PDF 38:00 - Running OPCUA-Client-...

00:00 - Introduction 00:45 - Start of nmap 03:20 - Using FFUF to VHOST Bruteforce and finding flow.helix.htb 05:30 - Looking into H2 Database RCE's, finding the Alias Command allows us the ability to run Java 07:10 - RCE #1: Using H2 Syntax to create an alias to run a shell command 15:10 - RCE #2: Adding a Processor to run Groovy 18:00 - RCE #3: Adding a Command Processor to run a bash command 19:40 - RCE #4: Is it easier to just use Metasploit? 26:00 - Shell on the box, using Find to show the types of all the files in our CWD and finding an SSH Key 30:15 - Shell as Operator, cracking a PDF 38:00 - Running OPCUA-Client-GUI and editing the registers to put the device in maintenance mode