Full Disclosure mailing list archives
Re: scada/plc gear
From: b9u4ea <b9u4ea () gmail com>
Date: Mon, 7 Jan 2008 11:37:30 -0600
There's a ton of information on the Internet for Schneider/Modicon's modbus protocol, including modbus+., modbusrtu, and modbustcp... Specs are freely available http://www.modbus.org/docs/Modbus_Application_Protocol_V1_1b.pdf. If you spend 2 minutes with google you'll find more then you'll need. For example: http://www.modbus.pl/download/zxy66/v19/modbus_perl_client.zip. Anyways, enjoy your research... On Jan 5, 2008 1:01 PM, gmaggro <gmaggro () rogers com> wrote:
OK, having done some digging a decent little chunk of industrial automation gear has started coming my way; 1 of 6 pieces. All totaled, roughly under $1000. Small standalone stuff for now; the shipping on populated PLC chassis like SLC-500 stuff is problematic. If people have specific technical questions, want a script run against a piece of gear or a custom protocol capture done I will entertain such requests. I am also willing to open the cases and pick up the soldering iron, attempt rom/firmware dumps, etc. Are there any particular tests or tools someone would like me to work into my routine right from the start? Hardware piece #1 is a Kohler Power Systems modbus/ethernet converter, pn# GM40165. So far, nmap (4.52) has been detecting the modbus running on port 502/tcp as asa-appl-proto. There is not a great deal of information out there about this protocol. The email contact associated with the port in some /etc/services files (ddube () modicon com) is disabled, and the domain redirects to an industrial automation company (telemecanique.com). Running/OS details indicate Enerdis or Lantronix embedded. MAC prefix is 00:20:4A (Pronet Gmbh). I suppose I could have just posted the nmap output, but figured that might annoy people unduly. Perhaps it would be worth renaming 'asa-appl-proto' on 502 to 'modbus' or something related? Just a suggestion to make it clearer for some people. In any case, this is mitigated by scanning with the -C option which grabs info from 80 and 161 clearly identifying it as being a modbus related device, the sysDescr stating "Modbus/TCP to RTU Bridge". And oh yeah, it has a wide open text configuration interface on 9999. Handy/Interesting modbus tcp/udp links: http://jamod.sourceforge.net/development/tcp_master_howto.html http://jamod.sourceforge.net/kbase/protocol.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- scada/plc gear gmaggro (Jan 05)
- Re: scada/plc gear b9u4ea (Jan 07)
- Re: scada/plc gear gmaggro (Jan 07)
- Re: scada/plc gear b9u4ea (Jan 08)
- Re: scada/plc gear gmaggro (Jan 09)
- Re: scada/plc gear gmaggro (Jan 07)
- Re: scada/plc gear b9u4ea (Jan 07)
- Re: scada/plc gear full disclosure (Jan 07)
- <Possible follow-ups>
- Re: scada/plc gear Worthless Email (Jan 09)
- Re: scada/plc gear b9u4ea (Jan 10)
- Re: scada/plc gear gmaggro (Jan 11)
- Re: scada/plc gear b9u4ea (Jan 10)
- Re: scada/plc gear gmaggro (Jan 15)
- Re: scada/plc gear gmaggro (Jan 15)
- Re: scada/plc gear gmaggro (Jan 24)