ics-ctf

name	ics-ctf
description	Lab/CTF: ICS/OT protocol challenges; Modbus, DNP3, BACnet, S7, OPC UA, MQTT, PLC/HMI data, registers/coils, safe read-only reasoning.
license	MIT
compatibility	AgentSkills-compatible agents; local artifacts; authorized isolated lab environments.
metadata	{"author":"AeonDave","version":"1.8","category":"ctf-solving"}

ICS CTF

Solve industrial-control and OT protocol lab tasks by treating traffic and process state as evidence first, then selecting the smallest safe action that proves the objective.

When this skill applies

• PCAPs, logs, register dumps, historian exports, or remote services involving PLC, HMI, RTU, engineering workstation, SCADA, or process-control wording.
• Protocol cues: Modbus/TCP, DNP3, BACnet, S7comm, EtherNet/IP/CIP, OPC UA, MQTT, Profinet, CAN, CANopen, serial fieldbus, coils, holding registers, function codes, setpoints, or actuator state.
• Tasks requiring traffic baselining, protocol-state reconstruction, register decoding, anomaly identification, or cautious interaction with an isolated lab service.

Operating model

1. Preserve and identify the artifact: hash files, list ports, extract timestamps, and record protocol guesses with evidence.
2. Separate roles before payloads: identify HMI, PLC, RTU, historian, engineering workstation, gateway, broker, and attacker-like clients.
3. Baseline normal behavior: polling interval, read/write ratio, function codes, register ranges, topics, tags, and repeated process cycles.
4. Decode semantics: map coils/registers/tags to values, infer endian/scaling, correlate writes with observed physical or process changes.
5. Prefer read-only validation. Only write or send commands when the target is clearly an isolated lab and the success oracle requires it.
6. Prove the result with a minimal, replayable signal: decoded secret, anomalous write, state transition, topic payload, register value, or process timeline.

Technique integration

Load these as decision engines when their domain appears:

• network-technique for PCAP, protocol, and service exposure analysis.
• forensic-technique for evidence handling, timelines, and artifact preservation.
• wireless-technique for RF, serial-over-radio, or fieldbus captures crossing into wireless analysis.
• reversing-technique for PLC program blocks, firmware, protocol clients, or custom encoders.
• python-patterns for parsers, register decoders, and safe replay harnesses.

Tool routing

Use tool families based on the evidence, not habit:

• wireshark, tcpdump, tshark, and zeek for protocol carving, conversations, timing, display filters (modbus.func_code, s7comm, dnp3, bacapp, cip, opcua, mqtt), and CSV/JSON field export.
• pymodbus, modbus-cli, mbtget, QModMaster, and ModbusPal for Modbus read/write, function-code abuse (FC 1–6, 15, 16, 8, 43), coil/register sweeps, and lab simulation.
• python-snap7, snap7-server, plcscan, and s7scan for Siemens S7 enumeration (rack/slot, SZL, DB reads) and lab targets.
• opcua-asyncio, FreeOpcUa, and OPCUaScanner for OPC UA endpoint enumeration, anonymous-policy detection, node browse, and read/write.
• mosquitto_pub/mosquitto_sub, mqtt-pwn, mosquitto-clients, MQTT Explorer/MQTTX, Scapy MQTT layer, MQTTSA, and the Wireshark mqtt + sparkplug dissectors for topic enumeration (#, $SYS/#), retained-message inspection, Sparkplug B (Eclipse Tahu / pysparkplug) decoding, broker fingerprinting (Mosquitto/EMQX/HiveMQ/VerneMQ/NanoMQ) and auth probing. Always pair with the adjacent dashboard port (EMQX 18083, HiveMQ 8080, Node-RED 1880, OpenPLC 8080, Home Assistant 8123) — it is usually the real entry point.
• can-utils (candump, cansniffer, cansend, cangen) for CAN bus capture, periodic-frame analysis, and replay against virtual vcan interfaces.
• CyberChef, jq, pandas, and Python scripts for endian, scaling, timestamp, register-table transformations, and CSV-from-pcap decoding pipelines.
• OT NSE scripts (, , , , , ) only against authorized isolated labs; passive PCAP analysis is preferred when artifacts are enough.

Safety and scope gates

• Treat real-world ICS/OT writes as unsafe by default. In lab tasks, document why the environment is isolated before any write.
• Never reset, stop, upload firmware, or mass-write registers unless the prompt explicitly defines an isolated target and the objective requires that exact action.
• Keep a pivot ledger: protocol hypothesis, field evidence, decoded meaning, validation signal, and next safest step.
• If traffic looks malformed, first test endian, scaling, segmentation, custom function codes, or encapsulation before assuming exploitation.
• Report uncertainty: process semantics are inferred unless confirmed by labels, HMI screens, historian tags, or repeated cause-effect evidence.

Quick pivots

• Modbus: map unit IDs, function codes (FC 1/2 read coils/discrete, FC 3/4 read holding/input, FC 5/6 single write, FC 15/16 multi write, FC 8 diagnostics, FC 43 device ID), coil/register ranges, write events, byte order, and byte-vs-word counts. Wireshark filter: modbus.func_code == 16 for write-multiple-registers events. Check BOTH register/reference number AND register value fields — flag-style data is often hidden in the address, transaction ID, or unit ID instead of the value.
• DNP3: inspect objects, variations, unsolicited responses, control relay outputs (group 12), and outstation/master roles. Filter: dnp3.
• BACnet: enumerate devices, objects, properties, write-property events, and broadcast discovery (Who-Is/I-Am). Filter: bacapp plus service choice.
• S7comm: identify rack/slot, SZL reads, data block accesses, and program/block transfer indicators. Filter: s7comm plus s7comm.param.func. Pair with plcscan/s7scan for lab enumeration and python-snap7 for DB reads.
• EtherNet/IP/CIP: decode sessions, class/instance/attribute paths, tag names, and explicit messaging. Filter: enip and cip.
• OPC UA: walk endpoint discovery, security policies (note None policy = anonymous), node IDs, and Browse/Read/Write services. Filter: opcua.
• MQTT: reconstruct topics/nodes, retained messages, client IDs, will payloads, and process-state deltas. Filter: mqtt. Try wildcard subscriptions # and $SYS/# when broker access is authorized; grab $SYS/broker/version + clients/total + retained messages/count first.
• Sparkplug B / MQTT-bridge pivot: topic prefix spBv1.0/<group>/<NBIRTH|NDATA|NCMD|DBIRTH|DDATA|DCMD>/<edge>[/<device>] with Protobuf payload signals an Ignition / Cirrus Link / EMQX Neuron / Node-RED bridge. Capture an NBIRTH/DBIRTH first to resolve alias→tag, then treat DCMD writes as actuator writes (Modbus FC 5/6 equivalent). Bridges (Cirrus Link, EMQX Neuron, Node-RED, OpenPLC MQTT, Advantech/Moxa/HMS gateways) round-trip MQTT writes into Modbus/S7/OPC-UA — confirm with state-topic lag (~1 s) before assuming raw broker access reaches the PLC.
• Mosquitto pivot: pull mosquitto.conf and passwd_file if a host is in scope (auth_plugin, bridge_*, , ); hashes crack with (PBKDF2-SHA512 mode for 2.x, legacy SHA512+salt for 1.x). Pin findings to and check vendor advisories (Mosquitto CVE-2017-7650 ACL pattern bypass, CVE-2024-3935 TLS DoS; EMQX/HiveMQ/VerneMQ banners similarly).

Resources

• references/ot-protocol-workflow.md — protocol triage, field extraction, anomaly workflow, and validation cues.
• references/plc-interaction-recipes.md — read-only-first interaction recipes for Modbus, S7, OPC UA, MQTT, and CAN against authorized lab targets, plus engineering-software pivot patterns.
• references/attack-patterns.md — Purdue-model mapping, engineering-workstation pivots, project-file formats, race-condition / FDI writes, L2 MITM in flat OT segments, HMI/historian pivots, and operational-impact reasoning.
• references/signal-decoding-and-testing.md — PLC scan cycle and memory areas, Modbus/CIP/S7/DNP3/BACnet decoding cues, integer/float/BCD/string/time encodings, byte-and-word order resolution, CAN signal decoding, the baseline → write → verify → restore test cycle, and a final validation checklist.
• references/fundamentals-and-it-to-ot-chain.md — OT priority model, asset taxonomy, Purdue recap, and a realistic IT→OT pivot chain for scoping and target selection.
• references/tia-portal-and-plc-fundamentals.md — Siemens S7-1500 / TIA Portal toolchain (project archives, HSP versioning, PLCSim Advanced offline simulation), OB/FB/FC/DB block taxonomy, S7-1500 memory areas (I/Q/M/DB/L), HMI tag binding, PROFINET DCP cell layout, and a step-by-step workflow for analyzing a seized project archive.
• references/incidents.md — OT incident pattern cards, vendor/CVE landing pads, and attack-path templates useful for recognizing or modeling realistic ICS-style tasks.
• references/mqtt-iot-ics-bridges.md — MQTT broker triage ($SYS fingerprinting, anonymous/retained/LWT/ACL probing), Sparkplug B topic + payload model (Eclipse Tahu), Mosquitto/EMQX/HiveMQ/VerneMQ/NanoMQ specifics with CVE references, MQTT-to-PLC bridge stacks (Cirrus Link Ignition modules, EMQX Neuron, Node-RED, OpenPLC, Advantech/Moxa/HMS gateways), tool chain (mqtt-pwn, mosquitto-clients, MQTT Explorer/MQTTX, MQTTSA, Scapy, Cotopaxi), recurring broker-challenge and home-automation attack patterns, and vendor/research case material (Akamai, Trend Micro, HiveMQ, Claroty Team82, CISA ICS advisories).