Machine Synopsis

`Helix` is a medium-difficulty Linux machine built around an industrial control system (ICS/OT) theme, where the intended path relies on understanding process behaviour rather than memory corruption or credential brute-forcing. Enumeration of the corporate site reveals a hidden subdomain hosting an Apache NiFi instance, which is vulnerable to a processor-based remote code execution flaw that grants an initial foothold as the `nifi` service account. Next, a backup SSH key left behind in a NiFi support bundle allows pivoting to the `operator` user and claiming the user flag. For privilege escalation, the `operator` account can reach an internal OPC UA server that models a live reactor. The crux of the box lies in a distinction between two similarly named concepts: the operator-controlled Maintenance mode and the safety-controller-granted privileged maintenance window. By abusing writable control variables to drive the reactor into a hazardous but non-tripping state, the safety controller is coerced into opening the privileged window, which in turn unlocks a `sudo`-executable maintenance console and yields root.