RowdyHacks XII: Cirno's Perfect Guest Access

Challenge

ICS/OT · 100 points. The scenario centers on a display and an HMI in a SCADA environment; no file attachment is provided.

Approach

The solve used the challenge's publicly exposed Misty Lake HMI view in SCADA-LTS. Its Fairy-HMI component rendered the flag directly, with no authentication required to reach that view. A teammate completed this one; the writeup records the reported guest-access exposure rather than any new access.

Takeaway

A reachable HMI is free reconnaissance. The common assumption that the OT network is already isolated leaves view access unauthenticated, so the moment you can route to the panel it hands over process state, set-points, and, here, the flag, with no credentials and no alerts. On a real engagement that exposed view is often the fastest way to map a plant before touching a single control. Authentication on every view would have closed it.

Flag

rowdy{Guest_4ccess_For_B4kas}