Re: [Full-disclosure] scada/plc gear



There's a ton of information on the Internet for Schneider/Modicon's
modbus protocol, including modbus+., modbusrtu, and modbustcp...
Specs are freely available
http://www.modbus.org/docs/Modbus_Application_Protocol_V1_1b.pdf. If
you spend 2 minutes with google you'll find more then you'll need.
For example: http://www.modbus.pl/download/zxy66/v19/modbus_perl_client.zip.
Anyways, enjoy your research...

On Jan 5, 2008 1:01 PM, gmaggro <gmaggro@xxxxxxxxxx> wrote:
OK, having done some digging a decent little chunk of industrial
automation gear has started coming my way; 1 of 6 pieces. All totaled,
roughly under $1000. Small standalone stuff for now; the shipping on
populated PLC chassis like SLC-500 stuff is problematic.

If people have specific technical questions, want a script run against a
piece of gear or a custom protocol capture done I will entertain such
requests. I am also willing to open the cases and pick up the soldering
iron, attempt rom/firmware dumps, etc.

Are there any particular tests or tools someone would like me to work
into my routine right from the start?

Hardware piece #1 is a Kohler Power Systems modbus/ethernet converter,
pn# GM40165.

So far, nmap (4.52) has been detecting the modbus running on port
502/tcp as asa-appl-proto. There is not a great deal of information out
there about this protocol. The email contact associated with the port in
some /etc/services files (ddube@xxxxxxxxxxx) is disabled, and the domain
redirects to an industrial automation company (telemecanique.com).
Running/OS details indicate Enerdis or Lantronix embedded. MAC prefix is
00:20:4A (Pronet Gmbh). I suppose I could have just posted the nmap
output, but figured that might annoy people unduly.

Perhaps it would be worth renaming 'asa-appl-proto' on 502 to 'modbus'
or something related? Just a suggestion to make it clearer for some
people. In any case, this is mitigated by scanning with the -C option
which grabs info from 80 and 161 clearly identifying it as being a
modbus related device, the sysDescr stating "Modbus/TCP to RTU Bridge".
And oh yeah, it has a wide open text configuration interface on 9999.

Handy/Interesting modbus tcp/udp links:

http://jamod.sourceforge.net/development/tcp_master_howto.html
http://jamod.sourceforge.net/kbase/protocol.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



Relevant Pages

  • Re: [Full-disclosure] scada/plc gear
    ... There's a ton of information on the Internet for Schneider/Modicon's modbus ... protocol, including modbus+., modbusrtu, and modbustcp... ... piece of gear or a custom protocol capture done I will entertain such ... Hosted and sponsored by Secunia - http://secunia.com/ ...
    (Full-Disclosure)
  • Re: "Multithreaded" tcl/tk problem?
    ... transfers and switches between independent GUI apps. ... protocol of communication). ... MODBUS on TCP/IP being something completely different to both MODBUS ... Now where Tcl/Tk comes from? ...
    (comp.lang.tcl)
  • Re: Need a simple protocol
    ... communications protocol which will allow a master to reliably ... The "MODBUS over Serial ... Line" protocol looks a good example of this. ... difficulty of marking the frame boundaries. ...
    (comp.arch.embedded)
  • Re: modbus and iec 870-5-102
    ... Modbus is another communication protocol used in automation business. ... These protocols don't have much in common. ... Schneider Electric/Telemechanique. ...
    (sci.engr.control)
  • Re: Need a simple protocol
    ... Rather than implementing a custom protocol I'm keen to use something ... The "MODBUS over Serial ... difficulty of marking the frame boundaries. ... The packet parsing requirement forces the serial receive ...
    (comp.arch.embedded)