THM - Brr

A writeup for “Brr” on TryHackMe.

You’ve been called in to assess an OT environment.

https://tryhackme.com/room/brr

Disclaimer

The content of this article is for educational purposes only. Do not use the techniques described here on any system without the explicit consent of the owner.

Footprinting

We can start by doing a scan with nmap.

PORT     STATE SERVICE      VERSION
80/tcp   open  http         WebSockify Python/3.12.3
|_http-title: Error response
|_http-server-header: WebSockify Python/3.12.3
| fingerprint-strings: 
|   GetRequest: 
|     HTTP/1.1 405 Method Not Allowed
|     Server: WebSockify Python/3.12.3
|     Date: Sat, 11 Jul 2026 17:12:43 GMT
|     Connection: close
|     Content-Type: text/html;charset=utf-8
|     Content-Length: 355
|_    ...
5020/tcp open  zenginkyo-1?
5901/tcp open  vnc          VNC (protocol 3.8)
| vnc-info: 
|   Protocol version: 3.8
|   Security types: 
|     VeNCrypt (19)
|     VNC Authentication (2)
|   VeNCrypt auth subtypes: 
|     Unknown security type (2)
|_    VNC auth, Anonymous TLS (258)
8080/tcp open  http         Apache Tomcat/Coyote JSP engine 1.1
|_http-open-proxy: Proxy might be redirecting requests
|_http-server-header: Apache-Coyote/1.1
|_http-title: ScadaBR CTF
| http-methods: 
|_  Potentially risky…