TryHackMe: Attacking ICS Plant #2 by dainok

The room Attacking ICS Plant #1 is a prerequisite. You should complete it and download scripts from there. The same scripts can be used to complete this room.

Before attacking the plant, identify the following registries:

• open/close the feed pump (PLC_FEED_PUMP);
• tank level sensor (PLC_TANK_LEVEL);
• open/close the outlet valve (PLC_OUTLET_VALVE);
• open/close the separator vessel valve (PLC_SEP_VALVE);
  *wasted oil counter (PLC_OIL_SPILL);
• processed oil counter (PLC_OIL_PROCESSED);
• open/close waste water valve (PLC_WASTE_VALVE).

VirtuaPlant can be downloaded from GitHub.

Task 2 Flag #1

Let the oil overflow the tank for at least 60 seconds. Then connect and get the flag1: http://10.10.246.71/flag1.txt.

Mind that the simulation should be reset before starting by pressing the ESC button. If the flag cannot be obtained, try to reset the room and start the attack again.

Read flag1.txt

Just browse to the URL listed above

Answer [REDACTED]

Task 3 Flag #2

Let the oil flow through the waste water valve only. Wait until the counter reaches 2000. Then connect and get the flag2: http://10.10.246.71/flag2.txt.

Mind that the simulation should be reset before starting by pressing the ESC button. If the flag cannot be obtained, try to reset the room and start the attack again.

Read flag2.txt

Ok so browsing the root of the webserver we get a remote desktop of the plat...

We need to Let the oil flow through the waste water valve only, so that means we probably need to shut off the Separator Vessel Valve and open the Outlet Valve.

First thing we need to do is head over to https://tryhackme.com/room/attackingics1 and grab the task files. If not already installed you will need pymodbus

pip3 install pymodbus  

Once installed we can use discover.py to start to see the registers

╰─⠠⠵ python3 discovery.py 10.10.246.71
 a  b  c  d  e  f  g  h  i  j  k  l  m  n  o  p
[0, 1, 1, 0, 0, 1, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0]
[0, 1, 1, 0, 0, 1, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0]
[0, 1, 1, 0, 0, 1, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0]

As we watch the registers change and the plant react we can start to fill out table to show what each register controls.

Using what we have observed we can gues that the register [REDACTED] is the measure of drops past the Water Valve, we can change this registers value and claim our flag.

python3 set_registry.py 10.10.246.71 [REDACTED] 2001

Answer: [REDACTED]