hacktricks/network-services-pentesting/47808-udp-bacnet.md

<details>

<summary><strong>Impara l'hacking di AWS da zero a eroe con</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>

Altri modi per supportare HackTricks:

* Se vuoi vedere la tua **azienda pubblicizzata su HackTricks** o **scaricare HackTricks in PDF** Controlla i [**PIANI DI ABBONAMENTO**](https://github.com/sponsors/carlospolop)!
* Ottieni il [**merchandising ufficiale di PEASS & HackTricks**](https://peass.creator-spring.com)
* Scopri [**The PEASS Family**](https://opensea.io/collection/the-peass-family), la nostra collezione di [**NFT**](https://opensea.io/collection/the-peass-family) esclusivi
* **Unisciti al** 💬 [**gruppo Discord**](https://discord.gg/hRep4RUj7f) o al [**gruppo Telegram**](https://t.me/peass) o **seguici** su **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* **Condividi i tuoi trucchi di hacking inviando PR ai repository** [**HackTricks**](https://github.com/carlospolop/hacktricks) e [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) su GitHub.

</details>


# Informazioni sul protocollo

**BACnet** è un **protocollo di comunicazione** per reti di automazione e controllo degli edifici (BAC) che sfrutta il protocollo standard **ASHRAE**, **ANSI** e **ISO 16484-5**. Agevola la comunicazione tra sistemi di automazione e controllo degli edifici, consentendo lo scambio di informazioni tra applicazioni come il controllo HVAC, il controllo dell'illuminazione, il controllo degli accessi e i sistemi di rilevazione incendi. BACnet garantisce l'interoperabilità e consente ai dispositivi di automazione degli edifici computerizzati di comunicare, indipendentemente dai servizi specifici che offrono.

**Porta predefinita:** 47808
```text
PORT      STATE SERVICE
47808/udp open  BACNet -- Building Automation and Control NetworksEnumerate
```
# Enumerazione

## Manuale
```bash
pip3 install BAC0
import BAC0
bbmdIP = '<IP>:47808'
bbmdTTL = 900
bacnet = BAC0.connect(bbmdAddress=bbmdIP, bbmdTTL=bbmdTTL) #Connect
bacnet.vendorName.strValue
#I couldn't find how to obtain the same data as nmap with this library or any other
#talk me if you know how please
```
## Automatico

BACnet is a protocol commonly used in building automation systems. It is based on UDP (User Datagram Protocol), which is a connectionless protocol that does not require a handshake between the client and the server.

BACnet allows devices in a building automation system to communicate with each other and exchange information. This can include data such as temperature, humidity, lighting control, and more.

When pentesting a network that uses BACnet, it is important to understand how the protocol works and how to exploit potential vulnerabilities. One common technique is to perform automatic discovery of BACnet devices on the network.

Automatic discovery involves sending BACnet Who-Is requests to the broadcast address of the network. This allows the pentester to identify all the BACnet devices present on the network.

Once the devices have been identified, the pentester can then proceed to perform further analysis and exploitation. This can include attempting to gain unauthorized access to the devices, manipulating their settings, or extracting sensitive information.

It is important to note that automatic discovery should only be performed on networks that you have permission to test. Unauthorized scanning of networks can be illegal and unethical.

In conclusion, automatic discovery of BACnet devices can be a useful technique when pentesting a network. It allows the pentester to identify potential targets for further analysis and exploitation. However, it is important to always obtain proper authorization before conducting any pentesting activities.
```bash
nmap --script bacnet-info --script-args full=yes -sU -n -sV -p 47808 <IP>
```
Questo script non cerca di unirsi a una rete BACnet come dispositivo esterno, ma invia semplicemente richieste BACnet direttamente a un dispositivo indirizzabile tramite IP.

## Shodan

* `port:47808 instance`
* `"Instance ID" "Vendor Name"`



<details>

<summary><strong>Impara l'hacking di AWS da zero a esperto con</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>

Altri modi per supportare HackTricks:

* Se vuoi vedere la tua **azienda pubblicizzata su HackTricks** o **scaricare HackTricks in formato PDF**, controlla i [**PACCHETTI DI ABBONAMENTO**](https://github.com/sponsors/carlospolop)!
* Ottieni il [**merchandising ufficiale di PEASS & HackTricks**](https://peass.creator-spring.com)
* Scopri [**The PEASS Family**](https://opensea.io/collection/the-peass-family), la nostra collezione di esclusive [**NFT**](https://opensea.io/collection/the-peass-family)
* **Unisciti al** 💬 [**gruppo Discord**](https://discord.gg/hRep4RUj7f) o al [**gruppo Telegram**](https://t.me/peass) o **seguici** su **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* **Condividi i tuoi trucchi di hacking inviando PR ai repository GitHub di** [**HackTricks**](https://github.com/carlospolop/hacktricks) e [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud).

</details>