10 KiB
☁️ HackTricks云 ☁️ -🐦 推特 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥
-
你在一个网络安全公司工作吗？你想在HackTricks中看到你的公司广告吗？或者你想获得PEASS的最新版本或下载PDF格式的HackTricks吗？请查看订阅计划！
-
发现我们的独家NFTs收藏品The PEASS Family
-
加入 💬 Discord群组 或 Telegram群组 或 关注我在Twitter上的🐦@carlospolopm.
-
通过向hacktricks repo和hacktricks-cloud repo提交PR来分享你的黑客技巧。
协议信息
BACnet是一种用于建筑自动化和控制（BAC）网络的通信协议，利用了ASHRAE、ANSI和ISO 16484-5标准[1]协议。
BACnet旨在允许建筑自动化和控制系统进行通信，用于应用程序，如供暖、通风和空调控制（HVAC）、照明控制、门禁控制和火灾检测系统及其相关设备。BACnet协议提供了计算机化建筑自动化设备交换信息的机制，无论它们执行的特定建筑服务是什么。 来自Wikipedia
默认端口： 47808
PORT STATE SERVICE
47808/udp open BACNet -- Building Automation and Control NetworksEnumerate
枚举
手动枚举
UDP BACnet is a protocol used for building automation and control networks. It is commonly used in industrial and commercial buildings to control and monitor various devices such as HVAC systems, lighting, and security systems.
UDP BACnet是一种用于建筑自动化和控制网络的协议。它通常用于工业和商业建筑中，用于控制和监控各种设备，如暖通空调系统、照明和安全系统。
To enumerate UDP BACnet services, you can use tools like nmap or bacnet-tool. These tools can help you discover BACnet devices on the network and gather information about them.
要枚举UDP BACnet服务，您可以使用nmap或bacnet-tool等工具。这些工具可以帮助您发现网络上的BACnet设备并收集有关它们的信息。
Here are some steps you can follow to manually enumerate UDP BACnet services:
以下是您可以按照的一些步骤手动枚举UDP BACnet服务：
-
Discover BACnet devices: Use tools like
nmapwith the BACnet script orbacnet-toolto discover BACnet devices on the network. These tools can send BACnet discovery requests and receive responses from devices.发现BACnet设备：使用带有BACnet脚本的工具，如
nmap或bacnet-tool，以发现网络上的BACnet设备。这些工具可以发送BACnet发现请求并接收设备的响应。 -
Gather device information: Once you have discovered BACnet devices, you can gather information about them using tools like
bacnet-tool. This information may include device names, device types, object types, and object properties.收集设备信息：一旦您发现了BACnet设备，您可以使用
bacnet-tool等工具收集有关它们的信息。这些信息可能包括设备名称、设备类型、对象类型和对象属性。 -
Enumerate objects and properties: With the gathered information, you can enumerate the objects and properties of the BACnet devices. This can help you understand the functionality and capabilities of the devices.
枚举对象和属性：利用收集到的信息，您可以枚举BACnet设备的对象和属性。这可以帮助您了解设备的功能和能力。
-
Exploit vulnerabilities: If you find any vulnerabilities in the BACnet devices, you can exploit them to gain unauthorized access or control over the devices. However, it is important to note that exploiting vulnerabilities without proper authorization is illegal.
利用漏洞：如果您发现BACnet设备中存在漏洞，您可以利用这些漏洞来获取未经授权的访问或对设备的控制。然而，重要的是要注意，未经适当授权的利用漏洞是非法的。
By following these steps, you can effectively enumerate UDP BACnet services and gather information about the devices on the network. This information can be useful for further analysis and potential exploitation.
pip3 install BAC0
import BAC0
bbmdIP = '<IP>:47808'
bbmdTTL = 900
bacnet = BAC0.connect(bbmdAddress=bbmdIP, bbmdTTL=bbmdTTL) #Connect
bacnet.vendorName.strValue
#I couldn't find how to obtain the same data as nmap with this library or any other
#talk me if you know how please
自动化
In the context of UDP BACnet, automatic refers to the process of automatically scanning and identifying BACnet devices on a network. This can be done using tools like BACnet discovery tools or network scanning tools.
在UDP BACnet的上下文中，自动化指的是自动扫描和识别网络上的BACnet设备的过程。可以使用BACnet发现工具或网络扫描工具来完成此操作。
Scanning
扫描
Scanning is the process of actively probing a network to identify open ports, services, and devices. In the case of UDP BACnet, scanning involves sending BACnet discovery packets to the network and analyzing the responses to identify BACnet devices.
扫描是主动探测网络以识别开放端口、服务和设备的过程。在UDP BACnet的情况下，扫描涉及向网络发送BACnet发现数据包，并分析响应以识别BACnet设备。
Discovery
发现
Discovery refers to the process of identifying and gathering information about BACnet devices on a network. This can include information such as device type, IP address, MAC address, and supported services.
发现是指识别和收集网络上的BACnet设备信息的过程。这可以包括设备类型、IP地址、MAC地址和支持的服务等信息。
Enumeration
枚举
Enumeration is the process of systematically listing and identifying the resources and services available on a network. In the context of UDP BACnet, enumeration involves querying BACnet devices for information such as object types, properties, and values.
枚举是系统地列出和识别网络上可用资源和服务的过程。在UDP BACnet的上下文中，枚举涉及查询BACnet设备以获取对象类型、属性和值等信息。
Exploitation
利用
Exploitation refers to the process of taking advantage of vulnerabilities or weaknesses in a system or network to gain unauthorized access or control. In the case of UDP BACnet, exploitation may involve exploiting vulnerabilities in BACnet devices to gain unauthorized access or manipulate the devices.
利用是指利用系统或网络中的漏洞或弱点来获取未经授权的访问或控制的过程。在UDP BACnet的情况下，利用可能涉及利用BACnet设备中的漏洞来获取未经授权的访问或操纵设备。
Mitigation
缓解
Mitigation refers to the process of reducing or minimizing the impact of vulnerabilities or risks. In the context of UDP BACnet, mitigation measures may include patching or updating BACnet devices, implementing network segmentation, and enforcing strong access controls.
缓解是指减少或最小化漏洞或风险影响的过程。在UDP BACnet的上下文中，缓解措施可能包括修补或更新BACnet设备、实施网络分割和执行强制访问控制。
nmap --script bacnet-info --script-args full=yes -sU -n -sV -p 47808 <IP>
这个脚本不会尝试作为外部设备加入BACnet网络，它只是直接向可寻址的IP设备发送BACnet请求。
Shodan
port:47808 instance"Instance ID" "Vendor Name"
☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥
-
你在一家网络安全公司工作吗？想要在HackTricks中宣传你的公司吗？或者你想要获取最新版本的PEASS或下载PDF格式的HackTricks吗？请查看订阅计划！
-
发现我们的独家NFT收藏品——The PEASS Family
-
加入💬 Discord群组或电报群组，或者关注我在Twitter上的🐦@carlospolopm。
-
通过向hacktricks仓库和hacktricks-cloud仓库提交PR来分享你的黑客技巧。