Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-22 20:53:37 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/network-services-pentesting/pentesting-modbus.md
Translator workflow e90c803209 Translated to Japanese
2023-07-07 23:42:27 +00:00

6.9 KiB
Raw Blame History

☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥

基本情報

Modbusプロトコルは、1979年にModiconによって開発されたメッセージング構造です。これは、インテリジェントデバイス間のマスタースレーブ/クライアントサーバー通信を確立するために使用されます。

デフォルトポート： 502

PORT    STATE SERVICE
502/tcp open  modbus

列挙

Modbus Enumeration

Modbus is a widely used protocol in industrial control systems (ICS) and is often targeted by attackers. To effectively pentest Modbus, it is important to first enumerate the target system.

Modbus TCP Enumeration

Nmap

Nmap can be used to scan for Modbus TCP services. The following command can be used:

nmap -p 502 --script modbus-discover <target>

Modscan

Modscan is a popular tool for Modbus enumeration. It can be used to scan for Modbus TCP services and gather information about the target system.

Modbus RTU Enumeration

Serial Port Scanning

To enumerate Modbus RTU devices, serial port scanning can be performed. Tools like modscan and mbpoll can be used to scan for Modbus RTU devices connected to serial ports.

Physical Inspection

Physical inspection of the target system can also provide valuable information about Modbus RTU devices. Look for devices with RS-485 or RS-232 ports, as these are commonly used for Modbus RTU communication.

Modbus Slave ID Enumeration

Modbus devices are identified by their slave IDs. Enumerating the slave IDs can provide insight into the target system's architecture and potential attack vectors.

Modscan

Modscan can be used to enumerate Modbus slave IDs. The following command can be used:

modscan32.exe -m tcp -a <target> -p 502 -s 1-255

Modbus Poll

Modbus Poll is another tool that can be used to enumerate Modbus slave IDs. The following command can be used:

modpoll -m tcp -a <target> -p 502 -s 1-255

Modbus Function Code Enumeration

Modbus function codes define the type of operation to be performed on the target system. Enumerating the function codes can help identify potential vulnerabilities.

Modscan

Modscan can be used to enumerate Modbus function codes. The following command can be used:

modscan32.exe -m tcp -a <target> -p 502 -s <slave_id> -f 1-255

Modbus Poll

Modbus Poll can also be used to enumerate Modbus function codes. The following command can be used:

modpoll -m tcp -a <target> -p 502 -s <slave_id> -f 1-255

Modbus Register Enumeration

Modbus registers store data in Modbus devices. Enumerating the registers can provide valuable information about the target system's configuration and potential attack vectors.

Modscan

Modscan can be used to enumerate Modbus registers. The following command can be used:

modscan32.exe -m tcp -a <target> -p 502 -s <slave_id> -r 0-65535

Modbus Poll

Modbus Poll can also be used to enumerate Modbus registers. The following command can be used:

modpoll -m tcp -a <target> -p 502 -s <slave_id> -r 0-65535

Conclusion

Enumeration is a crucial step in Modbus pentesting. By effectively enumerating the target system, you can gather valuable information that can be used to identify vulnerabilities and plan further attacks.

nmap --script modbus-discover -p 502 <IP>
msf> use auxiliary/scanner/scada/modbusdetect
msf> use auxiliary/scanner/scada/modbus_findunitid
☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥