[a44857437]

Does anyone have a hint / nudge for the last flag we need, "There is always another way" ?
It's the lautering PLC and we found the password, but need to bypass the write restrictions... (and yes, I now about pymodbustcp, but still stumped)

[anthony123]

If anyone still reading this topic..a nudge on WEB01 would be nice. Tried to scp an exploit to the system I have ssh creds for but nothing. Tried a few things w/ msfconsole as well but no luck.

Is that the initial foothold machine? If so, look for a request with a special parameter you can manipulate and try to 'respond' to it from your kali machine

---

Hint for WS02 -> list shares, maybe there are something you can do with the permission you have.

can u give a hint more precisely? I see there is development folder with write permission, then I don't have idea

See if you have permissions on that share, and maybe you can change that one file so it reaches out to you?

---

Need a hint on The secret is out!  flag for ALCHEMY-LAUTERING-PLC . It seems that need look something related to  inkate process. But strugling to understand what need to search and what we should to do.

how did you connect to the PLC's network? i couldn't find the subnet?

There's a client.ovpn on the EW machine for that

---

If anyone still reading this topic..a nudge on WEB01 would be nice. Tried to scp an exploit to the system I have ssh creds for but nothing. Tried a few things w/ msfconsole as well but no luck.

Quickly checked my notes...

As you already have SSH access, you can escalate to root (I used linux exploit suggester) and find another flag, then run ligolo-ng, chisel or whatever to tunnel to the internal network

before i didn't pwn the printer box so i couldn't find the right subnet, but now do you have any hints for the PLC's part? i've never work with this technology before

Can you please point me to the printer box or EW? I only found one subnet 172.x.x.x and the initial subnet 10.x.x.x. Is there something that I am missing?

[fayeA]

for SCADA( 0.20) root
hxxps://www.hackingarticles.in/lxd-privilege-escalation/
this is the way

[anthony123]

for SCADA( 0.20) root
hxxps://www.hackingarticles.in/lxd-privilege-escalation/
this is the way

Did you figure out anything related to PLC?

[fayeA]

for SCADA( 0.20) root
hxxps://www.hackingarticles.in/lxd-privilege-escalation/
this is the way

Did you figure out anything related to PLC?

No clue, sry

[IBLIIS]

Lets keep the thread as a learning opportunity and not aimlessly spoil content, future reference.

good mercii go testerrr caa

[learn666]

Lets keep the thread as a learning opportunity and not aimlessly spoil content, future reference.

[Bogyeman]

Can any one give a hins for PLC parts area 100 i have guest access for HMI and try with pymodbus and multiple way but no value return, I don't know the right way I should take.

[a44857437]

Can any one give a hins for PLC parts area 100 i have guest access for HMI and try with pymodbus and multiple way but no value return, I don't know the right way I should take.

Which IP addresses are you looking for? There are 2 area100 (a and b) IIRC...

[Bogyeman]

Can any one give a hins for PLC parts area 100 i have guest access for HMI and try with pymodbus and multiple way but no value return, I don't know the right way I should take.

Which IP addresses are you looking for? There are 2 area100 (a and b) IIRC...

A x.2 , x.3