{"id":1054,"date":"2025-12-20T18:42:00","date_gmt":"2025-12-20T18:42:00","guid":{"rendered":"https:\/\/zombierollz.blog\/?p=1054"},"modified":"2025-12-20T17:19:06","modified_gmt":"2025-12-20T17:19:06","slug":"aoc-2025-day-19-ics-modbus-claus-of-concern","status":"publish","type":"post","link":"https:\/\/zombierollz.blog\/?p=1054","title":{"rendered":"AoC 2025 – Day 19 – ICS Modbus – Claus of Concern"},"content":{"rendered":"\n

https:\/\/tryhackme.com\/room\/ICS-modbus-aoc2025-g3m6n9b1v4
Created by: tryhackme, h4sh3m00, empandaL0ver<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

A lot of reading in this room, but it’s important reading. THM goes over the importance of the SCADA system in this room. Nation-state threat actors that have Advanced Persistent Threats(APT) abilities target SCADA systems.<\/mark><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“What port is commonly used by Modbus TCP?”<\/mark><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

After a considerable amount of reading, we are now at the practical task. First off, we run an nmap scan. This might take a minute or two to complete. The 502 is our Modbus port.<\/mark><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Now we are instructed to go the web app where we can see CCTV footage and to our surprise our warehouse has been compromised!<\/mark><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

THM uses the Python interpreter in the terminal to connect to the Modbus interface. If you are new to Python, don’t fret if a lot of this seems like gibberish to you. The simplified wording of what we are looking at is:<\/mark>

if elves have control = Christmas
or if the bunnies have control = Eggmas<\/mark><\/p>\n\n\n\n

Read a long, and you will start noticing the why and how the warehouse system has been messed with. Below you will see the elif statement that changes the package_type to 1, which is for chocolate eggs. So if bunnies have control = chocolate eggs for Christmas!<\/mark><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

THM shows a few more examples of the compromised Modbus interface before tasking us with starting a Nano file, where we will copy and paste pre-written code.<\/mark><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

THM has us writing a new lengthy Python script. We need to copy and paste this to patch everything up and defeat Malhare. The script contains our flag as well!<\/mark><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

After this has been run, go back to the website, and we see that we pissed off the bunny king, but he looks like he has some plans scheming!<\/mark><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

This was a pretty cool room and shows the importance of protecting SCADA systems.
“If you enjoyed today’s room, feel free to check out our OT challenge:\u00a0Industrial Intrusion<\/a>“<\/p>\n","protected":false},"excerpt":{"rendered":"

https:\/\/tryhackme.com\/room\/ICS-modbus-aoc2025-g3m6n9b1v4Created by: tryhackme, h4sh3m00, empandaL0ver A lot of reading in this room, but it’s important reading. THM goes over the importance of the SCADA system in this room. Nation-state threat actors that have Advanced Persistent Threats(APT) abilities target SCADA systems. “What port is commonly used by Modbus TCP?” After a considerable amount of reading, we […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1054","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":8}},"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/1054","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1054"}],"version-history":[{"count":2,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/1054\/revisions"}],"predecessor-version":[{"id":1074,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/1054\/revisions\/1074"}],"wp:attachment":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1054"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1054"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1054"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}