As we saw in the cyber kill chain,
recon is the first step in planning and conducting a cyber attack.
It involves gathering information about a target that
will inform subsequent attack stages.
There are many specialist tools to support recon.
Shodan is arguably one of the most well‑known tools for ICS and OT recon.
Created by John Matherly,
Shodan is a search engine that lets users search for various types of
servers connected to the internet using a variety of filters,
such as SCADA, PLC, or Modbus, for example.
However, in this demo, we'll focus on another attack surface management tool,
Censys.
The activities shown in this course are legal in the
country in which they've been carried out.
If you want to recreate any of the activities illustrated in this course,
you should assure yourself that they're legal in the country and
region in which you're operating and that you have permission from
the owner of any systems that you test.
Censys is an attack surface management tool that
provides similar functionality to Shodan,
but offers more free searches per day.
However, to experience the full power of Censys,
you'll need to purchase a license.
In the most basic use case, we can search for an IP address.
Here we search for the Google public DNS address 8888,
which shows us that port 53 is open.
Users who explicitly change their DNS settings from those provided by
their ISP to 8888 can use the Google public DNS server.
However, we're interested in industrial control systems,
so let's try searching for a vendor such as Rockwell Automation.
We get 2670 results, which is a lot to work through manually.
Fortunately, Censys provides some useful filtering options.
Filtering by the Modbus protocol, for example,
or indeed port 502, reduces the number of results to 269.
Let's also filter on the GoAhead Webserver software service.
GoAhead is one of the most popular tiny embedded web servers and
is deployed in hundreds of millions of devices,
including industrial control systems.
Let's also filter on port 8383,
which is registered with IANA for machine‑to‑machine,
or M2M, communications.
This brings the number of results down to two.
Let's take a look at the first IP address.
We see port 80.
Whilst open, it's reporting a 302 Found,
which is presumably redirecting to port 443,
which is displaying a Web Admin Interface.
As expected, we see Modbus on port 502, and on port 8383,
we see an Enhanced Web Server.
On port 8585, we have the GoAhead Webserver.
Finally, we see that port 44818 is open.
In the context of Rockwell Automation,
port 44818 is commonly used for control logics and RSLinx Classic.
And in the decoded hex dump of the banner grab on that port,
we can identify the model number of the device.
The Rockwell 1769‑L30ER is a now discontinued Ethernet controller,
a good initial point of entry to an ICS environment.
Now I don't have the permission of the owner of this
system to access their equipment, so I won't follow the link.
But I have tested this type of equipment previously and have some
screenshots of what we might find if we were to follow it.
Here we see the same model number as the device found through Censys.
We can also see that the device reveals its MAC address,
internal IP address, and version number.
The version number might help us to identify known vulnerabilities later.
Exploring further, we find diagnostics information,
which provides network settings, including the subnet mask and gateway address.
And we could keep going through the various tabs to
find more and more information.
This is a screenshot of what I found on port 8383 of a very similar device,
which also hosted an Enhanced Web Server.
This port is commonly used for machine‑to‑machine communications.
Now, don't get me wrong,
logging is really important for both safety and security,
but logs provide a wealth of information for an attacker too,
so they should be protected.
Here I found various types of logs,
including process set points and security logs.
And this is what I found by following the Remote view link.
We have a Human‑Machine Interface, or HMI.
The graphical display indicates that there are sensors
measuring the pressure drop across a control valve.
There are also various indicators showing the
control status and parameter values,
as well as alerts for high‑pressure shutoff and so on.
Various buttons suggest we can set our view options and system setup,
as well as viewing reports, events, and trends.
Let's now take a different approach.
Instead of searching for a specific vendor,
let's search for an industrial protocol,
specifically PROFINET.
PROFINET is an industry standard for communicating
data over industrial Ethernet.
Let's narrow our search by looking for systems that use VNC,
a graphical desktop sharing system that uses the remote framebuffer
protocol to remotely control other computers.
Clicking on the first result, which is a host in Italy,
we see that port 102 suggests that we're looking at the Siemens S7‑300 PLC.
To help confirm this, we see that port 2455 is running Codesys,
which does lots of things, but its primary purpose is to run ladder logic,
a PLC programming language.
It also appears to be running the Nucleus PLUS operating system.
Port 5800 and 5900 provide remote access to the PLC via a smartphone,
tablet, or notebook as if you were standing right in front of the operator panel.
Of course, you need to have obtained or brute forced the right credentials.
Port 8080 looks interesting,
providing a WAGO Ethernet Web‑Based Management interface,
commonly used with Codesys as seen on port 2455.
Again, I don't have permission to access this device,
so I'm not going to, but I have come across various Siemens devices before.
Here's a screenshot of the web interface I found when I
looked at port 8082 of a similar 300 station.
Here we can see the firmware version,
which may allow us to identify vulnerabilities that we could
exploit to develop our attack planning.
In the Rack configuration tab,
we can see there's another device that's in RUN mode,
and its firmware version is also shown.
Exploring further, we can see the internal IP address of the PLC,
its subnet mask,
so we know we're dealing with a class C subnet and
can tailor our scans accordingly, and the default gateway for the network.
When I looked at port 8083 on a similar device,
I found a Miniweb server that provided basic information about the
image and bootloader version on the home page.
It also indicates that we have access to control functions,
but we need to log in first.
Failure to change default credentials is a common
vulnerability in ICS environments, and on some occasions,
after a quick Google search, we get lucky.
And on this occasion I did.
I was able to access a remote control interface via a Java
applet and press lots of buttons related to a tank and the
temperature of its contents.
In this screenshot of the Control Functions menu item,
we can see that we're able to import and export
recipes and user administration data.
Being able to import recipes means we could degrade
the quality of a product over time,
and being able to export recipes means we could steal intellectual
property and gain a commercial advantage over a competitor.
Moving on to the Diagnostics tab, we again see lots of log entries.
Logs and diagnostic records contain a huge amount of information
that could support furthering an attack campaign.
In this screenshot, we see we have access to a number of storage locations,
including files for the web interface itself in
WWW‑Root and various storage cards.
We could gather lots of information from each and any of these locations.
But when I went to the web server folder,
I found I also had the ability to upload files.
From here, I was able to upload a web shell to give me an alternative C2 channel.