Member-only story
THM - Kaboom
4 min readJun 29, 2026
A writeup for “Kaboom” on TryHackMe.
You’ve been called in to assess an OT environment.
The room involves interacting with a Modbus server to manipulate internal registers and coils, which simulate an OT environment.
https://tryhackme.com/room/kaboom
Disclaimer
The content of this article is for educational purposes only. Do not use the techniques described here on any system without the explicit consent of the owner.
Footprinting
We can start by doing a scan with nmap.
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 9e:c3:d2:f6:af:27:67:2b:ad:7a:3a:9b:44:11:2a:e1 (ECDSA)
|_ 256 c3:fa:af:82:d7:71:ce:48:42:3f:9f:97:1a:c9:a0:f7 (ED25519)
80/tcp open http Werkzeug/3.1.3 Python/3.12.3
|_http-server-header: Werkzeug/3.1.3 Python/3.12.3
|_http-title: PLC CCTV Simulator
102/tcp open iso-tsap Siemens S7 PLC
| s7-info:
| Module: 6ES7 315-2EH14-0AB0
| Basic Hardware: 6ES7 315-2EH14-0AB0
| Version: 3.2.6
| System Name: SNAP7-SERVER
| Module Type: CPU 315-2 PN/DP
| Serial Number: S C-C2UR28922012
|_ Copyright: Original Siemens Equipment
| fingerprint-strings:
| TerminalServerCookie:
|_…
