Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-22 20:53:37 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/network-services-pentesting/pentesting-modbus.md
Translator workflow 6af5d4e1a0 Translated to German
2024-02-10 15:36:32 +00:00

5.1 KiB
Raw Blame History

Lernen Sie AWS-Hacking von Null auf Held mit htARTE (HackTricks AWS Red Team Expert)!

Andere Möglichkeiten, HackTricks zu unterstützen:

Grundlegende Informationen

Im Jahr 1979 wurde das Modbus-Protokoll von Modicon entwickelt und dient als Nachrichtenstruktur. Es wird hauptsächlich verwendet, um die Kommunikation zwischen intelligenten Geräten zu erleichtern, die unter einem Master-Slave/Client-Server-Modell arbeiten. Dieses Protokoll spielt eine entscheidende Rolle bei der effizienten Datenübertragung zwischen Geräten.

Standardport: 502

PORT    STATE SERVICE
502/tcp open  modbus

Enumeration

Modbus Enumeration

Modbus is a widely used protocol in industrial control systems (ICS) and is often targeted by attackers. To effectively pentest a Modbus network, thorough enumeration is crucial. Enumeration involves gathering information about the Modbus devices and their configurations.

Scanning for Modbus Devices

To identify Modbus devices on a network, you can use tools like Nmap or Modscan. Nmap can be used with the following command:

nmap -p 502 --script modbus-discover <target>

Modscan is a dedicated tool for Modbus scanning and can be used as follows:

modscan32.exe <target>

Identifying Modbus Device Types

Once you have identified the Modbus devices, the next step is to determine their types. This information is crucial for further exploitation. Some common Modbus device types include:

  • Modbus TCP/IP: These devices use the TCP/IP protocol for communication.
  • Modbus RTU: These devices use the serial communication protocol.
  • Modbus ASCII: These devices use the ASCII character encoding for communication.

Gathering Modbus Device Information

To gather more information about the Modbus devices, you can use tools like Modscan or Modbus Poll. These tools allow you to query the devices and retrieve valuable information such as:

  • Device ID: Each Modbus device has a unique identifier.
  • Function Codes: These codes define the type of operation the device can perform.
  • Registers: Modbus devices use registers to store and retrieve data.

Analyzing Modbus Device Configurations

Analyzing the Modbus device configurations can provide insights into potential vulnerabilities. Some areas to focus on include:

  • Default Credentials: Check if the devices have default usernames and passwords.
  • Access Control: Determine if the devices have proper access control mechanisms in place.
  • Firmware Versions: Identify the firmware versions running on the devices and check for any known vulnerabilities.

By thoroughly enumerating the Modbus network and analyzing the device configurations, you can identify potential attack vectors and plan your exploitation accordingly.

nmap --script modbus-discover -p 502 <IP>
msf> use auxiliary/scanner/scada/modbusdetect
msf> use auxiliary/scanner/scada/modbus_findunitid
Lernen Sie AWS-Hacking von Null auf Held mit htARTE (HackTricks AWS Red Team Expert)!

Andere Möglichkeiten, HackTricks zu unterstützen: