Hello everyone and welcome back! Thank you for visiting. In today’s video we are hacking a factory that fills water bottles.
Here are my notes:
Most of the questions are just based on you reading the text and clicking once you’ve read them – then we come to actual questions. All are shown in the video but some are here so you can copy-paste or look into:
How many actuators can we observe?
[Include the button to start or stop the plant.(2) + change (general) ]
Start/stop button: registry 16.
Roller engine: registry 3.
Nozzle: registry 2 or 4. We need to spend additional time on that.
Using the script discovery.py, how many registers can we count?
[Look at the code]
After the plant is started and a bottle is loaded, how many registers are continuously changing their values? Lets look into the change:
entry1
[1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1]
entry2
[0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1]
Which registry is holding its value? Hmm
[ There is 16 numbers – reffer to Most commonly Modbus functions table (1-16) ]
[ Easily try 15 or 16, 16 works – Write Multiple Holding Registers]
[ But they meant to count the results, at the end there is always 1 – 16th one keeps writing]
[ it writes multiple holding registers ]
Which registries are set to 1 while the nozzle is filling a bottle?
[ Just look at the change considering what we know]
Which registries are set to 1 while the roller is moving the bottles?
[ Moving happens before nozzle fills the bottles, therefore we are gonna look at]
seems like its first and third
Which is the color of the water level sensor?
[ Open HTTP and look at VNC]
If you observe the plant at the very beginning, which is the registry associated with the roller?
[ It isnt the last one cause it was used for that other thing, at the beginning we have]
[ only one and three changing, since one is for coils 3 is our best guess ]
[ so roller is registry 3 ]
Based on the previous answer, which is the registry associated with the water level sensor?
[ Logically, only the registry number 1 stays. Turns out coils are for sensor stuff here]
- So nozzle is either 2 or 4, we wanna find out which
- Bottle position: 2 or 4 (green sensor)
- So we need to look into the green sensor
Which is the registry associated with the nozzle?
[ use python scripts to set registry values to 1 – use registries 2 and 4 ]
So conclusion is 4.It ignores the sensors
Shutdown the plant and avoid the plant manager starts it again.
[ python3 attack_shutdown.py IP ]
Start the plant, open the nozzle while bottles are moving.
[ Look at HTTP its hillarious ]
[ python3 attack_move_fill.py IP ]
Start the plant, open the nozzle and stop the rollet.
[x x 0 1 x x…. 1 ]
[ python3 attack_stop_fill.py IP]
Repeat attack in question 1 abusing sensor registries.
[ python3 attack_shutdown2.py IP ]
Repeat attack in question 2 abusing sensor registries.
[ attack_move_fill2.py]
Repeat attack in question 3 abusing sensor registries.
[ attack_stop_fill2.py]
Wanna do it manually? Cat into attack_stop_fill2.py
do it manually using set_registry.py (everything in while loop)
[ THANKS TO EVERYONE FOR WATCHING THAT WOULD BE ALL! ]
I know some questions are missing, they are in the video these are just the quick notes that i wrote while hacking.
