SMOD Tool MODBUS Penetration Testing Framework

We need to simply clone it from the github

Smod working

1. Once cloned we need to enter into the specific directory and type python smod.py in terminal
2. Then, type help you will be shown the options to explore the tools.
3. As this tool is written based on metasploit framework it is easy to explore
4. Type show modules to display the available modules and options for displaying the types.
5. Finally use the use command and select commands to set and exploit the things.
6. Exploit to see the coil and holding register value is changes
7. This tool can only be use for exploring modbus protocol nad for changing the coils and holding register value
8. This tool can be an offense if we try to exploit a real system with out granted permissions.
9. For more details refer video

 

SMOD >help

Command  Description                                     

 -------  -----------                                     

 back     Move back from the current context              

 exit     Exit the console                                

 exploit  Run module                                      

 help     Help menu                                       

 show     Displays modules of a given type, or all modules

 set      Sets a variable to a value                      

 use      Selects a module by name                        

SMOD >show modules

Modules                                       Description                                      

 -------                                       -----------                                      

 modbus/dos/arp                                DOS with Arp Poisoning                           

 modbus/dos/galilRIO                           DOS Galil RIO-47100

 modbus/dos/writeAllCoils                      DOS With Write All Coils                         

 modbus/dos/writeAllRegister                   DOS With Write All Register Function

 modbus/dos/writeSingleCoils                   DOS With Write Single Coil Function              

 modbus/dos/writeSingleRegister                DOS Write Single Register Function               

 modbus/function/fuzzing                       Fuzzing Modbus Functions                         

 modbus/function/readCoils                     Fuzzing Read Coils Function                      

 modbus/function/readCoilsException            Fuzzing Read Coils Exception Function            

 modbus/function/readDiscreteInput             Fuzzing Read Discrete Inputs Function            

 modbus/function/readDiscreteInputException    Fuzzing Read Discrete Inputs Exception Function  

 modbus/function/readExceptionStatus           Fuzzing Read Exception Status Function           

 modbus/function/readHoldingRegister           Fuzzing Read Holding Registers Function          

 modbus/function/readHoldingRegisterException  Fuzzing Read Holding Registers Exception Function

modbus/function/readInputRegister             Fuzzing Read Input Registers Function            

 modbus/function/readInputRegisterException    Fuzzing Read Input Registers Exception Function  

 modbus/function/writeSingleCoils              Fuzzing Write Single Coil Function               

 modbus/function/writeSingleRegister           Fuzzing Write Single Register Function           

 modbus/scanner/arpWatcher                     ARP Watcher                                      

 modbus/scanner/discover                       Check Modbus Protocols                           

 modbus/scanner/getfunc                        Enumeration Function on Modbus                   

 modbus/scanner/uid                            Brute Force UID                                  

 modbus/sniff/arp                              Arp Poisoning  

SMOD >

Brute Force Modbus UID

SMOD >use modbus/scanner/uid

SMOD modbus(uid) >show options

Name      Current Setting  Required  Description                                

 ----      ---------------  --------  -----------                                

 Function  1                False     Function code, Defualt:Read Coils.         

 Output    True             False     The stdout save in output directory        

 RHOSTS                     True      The target address range or CIDR identifier

 RPORT     502              False     The port number for modbus protocol        

 Threads   1                False     The number of concurrent threads           

 SMOD modbus(uid) >set RHOSTS 192.168.1.6

 SMOD modbus(uid) >exploit

[+] Module Brute Force UID Start

[+] Start Brute Force UID on : 192.168.1.6

[+] UID on 192.168.1.6 is : 10

SMOD modbus(uid) >

Enumeration Function on Modbus

SMOD >use modbus/scanner/getfunc

SMOD modbus(getfunc) >show options

Name     Current Setting  Required  Description                                 

 ----     ---------------  --------  -----------                                

 Output   True             False     The stdout save in output directory        

 RHOSTS                    True      The target address range or CIDR identifier

 RPORT    502              False     The port number for modbus protocol        

 Threads  1                False     The number of concurrent threads           

 UID      None             True      Modbus Slave UID.                          

SMOD modbus(getfunc) >set RHOSTS 192.168.1.6

SMOD modbus(getfunc) >set UID 10

SMOD modbus(getfunc) >exploit

[+] Module Get Function Start

[+] Looking for supported function codes on 192.168.1.6

[+] Function Code 1(Read Coils) is supported.

[+] Function Code 2(Read Discrete Inputs) is supported.

[+] Function Code 3(Read Multiple Holding Registers) is supported.

[+] Function Code 4(Read Input Registers) is supported.

[+] Function Code 5(Write Single Coil) is supported.

[+] Function Code 6(Write Single Holding Register) is supported.

[+] Function Code 7(Read Exception Status) is supported.

[+] Function Code 8(Diagnostic) is supported.

[+] Function Code 15(Write Multiple Coils) is supported.

[+] Function Code 16(Write Multiple Holding Registers) is supported.

[+] Function Code 17(Report Slave ID) is supported.

[+] Function Code 20(Read File Record) is supported.

[+] Function Code 21(Write File Record) is supported.

[+] Function Code 22(Mask Write Register) is supported.

[+] Function Code 23(Read/Write Multiple Registers) is supported.

SMOD modbus(getfunc) >

Fuzzing Read Coils Function

SMOD >use modbus/function/readCoils

SMOD modbus(readCoils) >show options

Name       Current Setting  Required  Description                                

 ----       ---------------  --------  -----------                                

 Output     True             False     The stdout save in output directory        

 Quantity   0x0001           True      Registers Values.                          

 RHOSTS                      True      The target address range or CIDR identifier

 RPORT      502              False     The port number for modbus protocol        

 StartAddr  0x0000           True      Start Address.                             

 Threads    1                False     The number of concurrent threads           

 UID        None             True      Modbus Slave UID.                          

SMOD modbus(readCoils) >set RHOSTS 192.168.1.6

SMOD modbus(readCoils) >set UID 10

SMOD modbus(readCoils) >exploit

[+] Module Read Coils Function Start

[+] Connecting to 192.168.1.6

[+] Response is :

###[ ModbusADU ]###

  transId   = 0x2

  protoId   = 0x0

  len       = 0x4

  unitId    = 0xa

###[ Read Coils Answer ]###

     funcCode  = 0x1

     byteCount = 1L

     coilStatus= [0]

SMOD modbus(readCoils) >