Re: [Full-disclosure] scada/plc gear



There's a ton of information on the Internet for Schneider/Modicon's
modbus protocol, including modbus+., modbusrtu, and modbustcp...
Specs are freely available
http://www.modbus.org/docs/Modbus_Application_Protocol_V1_1b.pdf. If
you spend 2 minutes with google you'll find more then you'll need.
For example: http://www.modbus.pl/download/zxy66/v19/modbus_perl_client.zip.
Anyways, enjoy your research...

On Jan 5, 2008 1:01 PM, gmaggro <gmaggro@xxxxxxxxxx> wrote:
OK, having done some digging a decent little chunk of industrial
automation gear has started coming my way; 1 of 6 pieces. All totaled,
roughly under $1000. Small standalone stuff for now; the shipping on
populated PLC chassis like SLC-500 stuff is problematic.

If people have specific technical questions, want a script run against a
piece of gear or a custom protocol capture done I will entertain such
requests. I am also willing to open the cases and pick up the soldering
iron, attempt rom/firmware dumps, etc.

Are there any particular tests or tools someone would like me to work
into my routine right from the start?

Hardware piece #1 is a Kohler Power Systems modbus/ethernet converter,
pn# GM40165.

So far, nmap (4.52) has been detecting the modbus running on port
502/tcp as asa-appl-proto. There is not a great deal of information out
there about this protocol. The email contact associated with the port in
some /etc/services files (ddube@xxxxxxxxxxx) is disabled, and the domain
redirects to an industrial automation company (telemecanique.com).
Running/OS details indicate Enerdis or Lantronix embedded. MAC prefix is
00:20:4A (Pronet Gmbh). I suppose I could have just posted the nmap
output, but figured that might annoy people unduly.

Perhaps it would be worth renaming 'asa-appl-proto' on 502 to 'modbus'
or something related? Just a suggestion to make it clearer for some
people. In any case, this is mitigated by scanning with the -C option
which grabs info from 80 and 161 clearly identifying it as being a
modbus related device, the sysDescr stating "Modbus/TCP to RTU Bridge".
And oh yeah, it has a wide open text configuration interface on 9999.

Handy/Interesting modbus tcp/udp links:

http://jamod.sourceforge.net/development/tcp_master_howto.html
http://jamod.sourceforge.net/kbase/protocol.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



Relevant Pages

  • Re: Ada for Automation
    ... Don't you find it strange that you'd need a special hardware to communicate ... The board must support some network protocol where all ... ModBus is clear favorite. ... Please design a drive, an encoder, an IO module, what ever you want, and then try to address the market. ...
    (comp.lang.ada)
  • Re: [Full-disclosure] scada/plc gear
    ... There's a ton of information on the Internet for Schneider/Modicon's modbus ... protocol, including modbus+., modbusrtu, and modbustcp... ... piece of gear or a custom protocol capture done I will entertain such ... Hosted and sponsored by Secunia - http://secunia.com/ ...
    (Full-Disclosure)
  • Re: Ada for Automation
    ... Don't you find it strange that you'd need a special hardware to communicate ... Such high speed data are processed in the terminals which provide integral ... The board must support some network protocol where all ... ModBus is clear favorite. ...
    (comp.lang.ada)
  • Re: "Multithreaded" tcl/tk problem?
    ... transfers and switches between independent GUI apps. ... protocol of communication). ... MODBUS on TCP/IP being something completely different to both MODBUS ... Now where Tcl/Tk comes from? ...
    (comp.lang.tcl)
  • Re: Need a simple protocol
    ... communications protocol which will allow a master to reliably ... The "MODBUS over Serial ... Line" protocol looks a good example of this. ... difficulty of marking the frame boundaries. ...
    (comp.arch.embedded)