Helix Writeup - HackTheBox
Last updated May 14, 2026 • 9 min read
1. Reconnaissance
Fast TCP Port Scan
Start with a fast scan to identify open ports quickly.
Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-10 18:45 +0500 Nmap scan report for $TARGET_IP Host is up (0.22s latency). Not shown: 986 closed tcp ports (reset), 12 filtered tcp ports (no-response) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http Nmap done: 1 IP address (1 host up) scanned in 6.84 seconds
Two ports are open: SSH (22) and HTTP (80). Simple attack surface — let's dig deeper.
Service & Version Detection
Run a detailed scan with service detection and default scripts against the two open ports.
Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-10 18:46 +0500 Nmap scan report for $TARGET_IP Host is up (0.50s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.15 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 60:b3:f7:6c:0b:92:ab:00:ac:e7:12:e1:d1:26:9c:1e (ECDSA) |_ 256 c8:30:e6:cb:c6:cd:fc:0c:39:e5:34:04:20:07:b9:b3 (ED25519) 80/tcp open http nginx 1.18.0 (Ubuntu) |_http-server-header: nginx/1.18.0 (Ubuntu) |_http-title: Did not follow redirect to http://helix.htb/ Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
The HTTP server redirects to http://helix.htb/ — this tells us the web app is using virtual hosting. We need to add this hostname to our /etc/hosts file to resolve it.
Add Hostnames to hosts
$TARGET_IP helix.htb
Now helix.htb resolves locally to the target IP. The site loads, but it appears largely static. Time to look for hidden virtual hosts.
Protected Writeup
This has not retired yet on HackTheBox. We only publish writeups for retired machines and challenges. Once it retires, this writeup will become publicly accessible.