Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-23 05:03:35 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/network-services-pentesting/47808-udp-bacnet.md
Translator workflow 99e7865a3e Translated to Italian
2024-02-10 13:03:23 +00:00

5.2 KiB
Raw Blame History

Impara l'hacking di AWS da zero a eroe con htARTE (HackTricks AWS Red Team Expert)!

Altri modi per supportare HackTricks:

Informazioni sul protocollo

BACnet è un protocollo di comunicazione per reti di automazione e controllo degli edifici (BAC) che sfrutta il protocollo standard ASHRAE, ANSI e ISO 16484-5. Agevola la comunicazione tra sistemi di automazione e controllo degli edifici, consentendo lo scambio di informazioni tra applicazioni come il controllo HVAC, il controllo dell'illuminazione, il controllo degli accessi e i sistemi di rilevazione incendi. BACnet garantisce l'interoperabilità e consente ai dispositivi di automazione degli edifici computerizzati di comunicare, indipendentemente dai servizi specifici che offrono.

Porta predefinita: 47808

PORT      STATE SERVICE
47808/udp open  BACNet -- Building Automation and Control NetworksEnumerate

Enumerazione

Manuale

pip3 install BAC0
import BAC0
bbmdIP = '<IP>:47808'
bbmdTTL = 900
bacnet = BAC0.connect(bbmdAddress=bbmdIP, bbmdTTL=bbmdTTL) #Connect
bacnet.vendorName.strValue
#I couldn't find how to obtain the same data as nmap with this library or any other
#talk me if you know how please

Automatico

BACnet is a protocol commonly used in building automation systems. It is based on UDP (User Datagram Protocol), which is a connectionless protocol that does not require a handshake between the client and the server.

BACnet allows devices in a building automation system to communicate with each other and exchange information. This can include data such as temperature, humidity, lighting control, and more.

When pentesting a network that uses BACnet, it is important to understand how the protocol works and how to exploit potential vulnerabilities. One common technique is to perform automatic discovery of BACnet devices on the network.

Automatic discovery involves sending BACnet Who-Is requests to the broadcast address of the network. This allows the pentester to identify all the BACnet devices present on the network.

Once the devices have been identified, the pentester can then proceed to perform further analysis and exploitation. This can include attempting to gain unauthorized access to the devices, manipulating their settings, or extracting sensitive information.

It is important to note that automatic discovery should only be performed on networks that you have permission to test. Unauthorized scanning of networks can be illegal and unethical.

In conclusion, automatic discovery of BACnet devices can be a useful technique when pentesting a network. It allows the pentester to identify potential targets for further analysis and exploitation. However, it is important to always obtain proper authorization before conducting any pentesting activities.

nmap --script bacnet-info --script-args full=yes -sU -n -sV -p 47808 <IP>

Questo script non cerca di unirsi a una rete BACnet come dispositivo esterno, ma invia semplicemente richieste BACnet direttamente a un dispositivo indirizzabile tramite IP.

Shodan

  • port:47808 instance
  • "Instance ID" "Vendor Name"
Impara l'hacking di AWS da zero a esperto con htARTE (HackTricks AWS Red Team Expert)!

Altri modi per supportare HackTricks: