Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-22 04:33:28 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/network-services-pentesting/47808-udp-bacnet.md
Translator workflow b442ae90c4 Translated to Klingon
2024-02-10 17:52:19 +00:00

2700 lines
21 KiB
Markdown
Raw Permalink Blame History

<details>
<summary><strong>htARTE (HackTricks AWS Red Team Expert)</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>!HackTricks AWS Red Team Expert</strong></a><strong>!</strong></summary>
Other ways to support HackTricks:
* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
</details>
# Protocol Information
**BACnet** is a **communications protocol** for Building Automation and Control (BAC) networks that leverages the **ASHRAE**, **ANSI**, and **ISO 16484-5 standard** protocol. It facilitates communication among building automation and control systems, enabling applications such as HVAC control, lighting control, access control, and fire detection systems to exchange information. BACnet ensures interoperability and allows computerized building automation devices to communicate, regardless of the specific services they provide.
**Default port:** 47808
```text
PORT STATE SERVICE
47808/udp open BACNet -- Building Automation and Control NetworksEnumerate
```
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
## Manual
# Enumeration
```bash
pip3 install BAC0
import BAC0
bbmdIP = '<IP>:47808'
bbmdTTL = 900
bacnet = BAC0.connect(bbmdAddress=bbmdIP, bbmdTTL=bbmdTTL) #Connect
bacnet.vendorName.strValue
#I couldn't find how to obtain the same data as nmap with this library or any other
#talk me if you know how please
```
## Qapla'
### Automatic
#### Description
The Automatic function in BACnet allows devices to automatically discover and configure network settings. This can be useful for attackers as it provides a way to gather information about the network and potentially exploit vulnerabilities.
#### Exploitation
To exploit the Automatic function in BACnet, an attacker can send a specially crafted message to a device on the network. This message can trigger the device to reveal information about its network settings, such as IP addresses, subnet masks, and default gateways.
#### Mitigation
To mitigate the risk of exploitation through the Automatic function in BACnet, it is recommended to disable or restrict access to this feature. Additionally, network segmentation and access control measures can be implemented to limit the exposure of BACnet devices to potential attackers.
#### References
- [BACnet Protocol](https://en.wikipedia.org/wiki/BACnet)
- [BACnet Security](https://www.bacnetinternational.org/associations/8060/files/Security%20Guidelines%20for%20BACnet%20Networks.pdf)
```bash
nmap --script bacnet-info --script-args full=yes -sU -n -sV -p 47808 <IP>
```
vaj script vItlhutlh BACnet network vItlhutlh vay' IP addressable device.
## Shodan
* `port:47808 instance`
* `"Instance ID" "Vendor Name"`
<details>
<summary><strong>Learn AWS hacking from zero to hero with</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
Other ways to support HackTricks:
* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
</details>
Reference in a new issue View git blame Copy permalink