| name | hunt-ics |
| description | ICS/SCADA/OT exploitation - Modbus (502), S7comm (102), EtherNet/IP (44818), DNP3, OpenPLC, Node-RED SCADA, PLC/HMI/coil/holding-register attacks. Use when a target exposes industrial protocols or the goal is to drive a plant to a dangerous state (over-pressure/over-speed/disable interlock) and read the flag the HMI/CCTV reveals. |
Hunt: ICS / SCADA / OT
Assumes hunt-core for the scope gate, two-account rule, confirmation gate, enumeration limits, stop conditions, wiki protocol, FIND output, and Deadends. Do not re-derive any of that here.
SAFETY - hard stop, overrides everything below
Writing to a live PLC moves real machinery: it can over-pressure a vessel, over-speed a motor, or disable a safety interlock, and so damage equipment or injure and kill people. Only ever drive a process toward a dangerous state on a target that is EXPLICITLY an authorized lab or CTF simulation. Never on a real plant, and never when scope carries no_dos/passive_only - there OT is READ-ONLY (FC1-4), never write (FC5/6/15/16). The instant the objective is met (e.g. the flag the HMI/CCTV reveals is in hand), STOP writing and revert any coil/register you changed if you can. This is a hard stop and it outranks every other note in this file.
Wiki
qmd_query "ICS SCADA OT Modbus S7comm EtherNet/IP DNP3 OpenPLC Node-RED PLC HMI coil holding register" via wiki-search MCP
Hub: [[network-moc]] (live index). Primary page: [[ics-scada-modbus]]. Payload arsenal: wiki/payloads/modbus.md.
Anchors: [[iot-attacks]], [[firmware-hardware]].
Attack surface (ranked by exploitation value)
- Modbus / TCP 502 - no auth, no session, trivially readable AND writable. The primary lever: FC1-4 read coils/registers, FC5/6/15/16 write them. Highest value, highest danger.
- OpenPLC web (8080) and Node-RED (1880, dashboard ) - the SCADA/IT side that drives the PLC. OpenPLC routes ; authed OpenPLC = upload-program RCE. Node-RED socket.io config NAMES the registers.
