[a44857437]

Can any one give a hins for PLC parts area 100 i have guest access for HMI and try with pymodbus and multiple way but no value return, I don't know the right way I should take.

Which IP addresses are you looking for? There are 2 area100 (a and b) IIRC...

A x.2 , x.3

DM me

[krak3n]

Would anyone be able to please provide some hints for how to proceed?, so far I've got:
- User/root on 10.10.110.21 (Web01).
- User/root on 172.16.0.20 (SCADA).
- User/root on 172.16.0.3 (Web02).

Struggling to find a foothold on the other machines.

[anthony123]

Would anyone be able to please provide some hints for how to proceed?, so far I've got:
- User/root on 10.10.110.21 (Web01).
- User/root on 172.16.0.20 (SCADA).
- User/root on 172.16.0.3 (Web02).

Struggling to find a foothold on the other machines.

Check your nmap results, check the subnets on Web01 and find other live hosts. There are already enough hints on this post to get you until the PLC machine. Feel free to DM if you need any more help.

[anthony123]

Would anyone be able to please provide some hints for how to proceed?, so far I've got:
- User/root on 10.10.110.21 (Web01).
- User/root on 172.16.0.20 (SCADA).
- User/root on 172.16.0.3 (Web02).

Struggling to find a foothold on the other machines.

IDK but I am not able to reply you back. But try enumerating the services on the other hosts and try to see if you can "use" something that you already have.

---

Would anyone be able to please provide some hints for how to proceed?, so far I've got:
- User/root on 10.10.110.21 (Web01).
- User/root on 172.16.0.20 (SCADA).
- User/root on 172.16.0.3 (Web02).

Struggling to find a foothold on the other machines.

Also there are enough hints in this thread already related to the other hosts. Take a look at them carefully. Just do not overthink. I had been overthinking and tried some advanced stuff missing simple things that got me access. XD

[me1476]

Any nudge on .4?
I stuck there for a while, and it's the last one. I could share nudge on some other in return

[semi9o]

Hi,
I’m looking for Writeups for the Alchemy Pro Labs challenge on HTB. If anyone can share or help, please DM me.

Thanks!

[anthony123]

Any nudge on .4?
I stuck there for a while, and it's the last one. I could share nudge on some other in return

Is it the PLC one?

[me1476]

Any nudge on .4?
I stuck there for a while, and it's the last one. I could share nudge on some other in return

Is it the PLC one?

Yep.

Since there is variety in 172.19.x.1-14.
X is random when you connect to PLC

[moonwalk8697]

Which subnet is PRINTER in? The same as EW?

I have the .ovpn file, but feel like I'm missing some critical information about next steps because I've yet to find PRINTER. Maybe my lab environment being weird...

[me1476]

Which subnet is PRINTER in? The same as EW?

I have the .ovpn file, but feel like I'm missing some critical information about next steps because I've yet to find PRINTER. Maybe my lab environment being weird...

Yep, it should be on the same network as EW.
And yeah, I would recommend closing all IT parts before moving to PLC cause there is a lot of information hidden in docs.

---

I finally got .4 PLC and 100%

RTFM. In one of the documents, there was hint about that device.

Here are some hints that will save a lot of time for you:
- PLC logic is working. It seems it's doing nothing, but it's cause one of the parameters is not set automatically and requires a manual set.
- 5000 port on PLC (.5) - useless. Don't waste your time.
- sp_1 and sp_2 it's not before-after. It's single-value
- In the flag, assume time as duration, which will save you a lot of time.
- final_boil_time is not the same as in the ST code. As I mentioned - it's duration.