Ever broken into a cold sweat after realizing that the "totally isolated" massive factory you're testing is actually waving hello to the public internet through a 10-year-old, unencrypted VNC screen? If you haven't, then you haven't truly experienced an Industrial Control Systems (ICS/OT) penetration test yet, my friend.
Usually, as the Red Team crowd, we’re busy roaming around Windows domains, Kerberoasting service accounts, or trying to dance around EDRs. But the moment you step behind those rusty pipes and face boxes labeled "Siemens," "Schneider," or "Rockwell," the rules of the game change dramatically. Here, the "move fast and break things" philosophy won't just get you fired; it could literally cut the power to an entire city or, in the worst-case scenario, make a factory physically go boom.
The Air-Gap is a Urban Legend
Let me let you in on a secret: A truly isolated industrial network is as rare as a unicorn. Whenever we show up for a pentest (let's call the client testCompany), and they say, "Sedat, our production line is completely closed off, it's only accessible internally," I immediately start checking the Wi-Fi list on my phone.
Usually, tucked away somewhere in that "isolated" network, there's a tired maintenance engineer who plugged in a 4G modem to work from home, or some "innovative" IoT gateway trying to push telemetry to the cloud.
In the IT world, if a server crashes, we reboot it or roll back to a snapshot. In the OT world, if a PLC (Programmable Logic Controller) hangs, a physical process stops. Liquid iron freezes in the crucibles, pressure spikes in the lines, or safety valves lock up. This is why running nmap -T4 -A in an industrial environment is like bringing a sledgehammer into a porcelain shop. The TCP stacks on those legacy PLCs are so fragile that even a slightly aggressive port scan can trigger a kernel panic.
Modbus: The Protocol That Security Forgot
One of the most common protocols you'll run into in the industrial wild is Modbus. It was designed in 1979. Yeah, you heard that right—the same year the Walkman came out. Back then, "cybersecurity" wasn't even a word, so they didn't bother with things like authentication or encryption.
If you have access to a device using Modbus (usually on port 502), you are essentially the king of that device. It won't ask for a username or password; it just gives you permission to read and write to memory areas called "Holding Registers."
Let's get our hands a bit dirty. Suppose you've found a PLC on the internal network. Python and the pymodbus library are going to be your best friends. Check out this simple script to see how easy it is to read a device's registers:
from pymodbus.client import ModbusTcpClient
# Target PLC IP address
plc_ip = '192.168.50.10'
client = ModbusTcpClient(plc_ip, port=502)
if client.connect():
print(f"[+] Connection successful: {plc_ip}")
# Read 10 registers starting from address 0
# These registers could represent temperature, pressure, or motor speed
result = client.read_holding_registers(0, 10)
if not result.isError():
print(f"[*] Register Values: {result.registers}")
else:
print("[-] Could not read registers.")
client.close()
else:
print(f"[-] Connection failed: {plc_ip}")
In a real-world scenario, those values you see in the output aren't just numbers—they are the heartbeat of the plant. One wrong write_register command and you could be changing the cooling rate of a reactor. Scary, right? This is why OT security is a completely different beast. We aren't just protecting data; we're protecting the physical world.