When you see the 0x05 (Write Single Coil) function code in a Modbus TCP packet, the countdown for a valve to close or a motor to stop on that line has already begun. Unless you have mTLS or a protocol-level verification mechanism in place, all an attacker needs to do is find the right register address.
Greetings everyone. Today, we’re stepping into a world that’s a bit dusty, a bit oily, but incredibly dangerous: OT (Operational Technology), or industrial security. This isn't like hacking an office laptop. In the office, the worst-case scenario is data theft; here, things physically explode, burn, or come to a grinding halt. One of the biggest misconceptions I've encountered during my time in the field is the phrase, 'Buddy, our system is closed to the outside world, we have an air-gap.' Spoiler alert: That air-gap never truly exists. A single USB stick, a maintenance engineer's laptop, or a misconfigured DMZ can shatter that myth in seconds.
The Innocence and Vulnerability of Protocols
Most protocols used in industrial systems (Modbus, S7Comm, BACnet, EtherNet/IP) were designed in the '70s and '80s. Back then, 'security' only meant one thing: the lock on the door. These protocols don't have 'modern' inventions like authentication, encryption, or integrity checks in their DNA.
Think about it; let's say we’re auditing a production line within testCompany. These devices we call PLCs (Programmable Logic Controllers) accept every packet they receive as if it came 'straight from their father.' If the packet format is correct, the command is executed.
Let’s look at an example Modbus TCP packet structure (defanged):
Transaction Identifier: 0x1234
Protocol Identifier: 0x0000
Length: 0x0006
Unit Identifier: 0x01
Function Code: 0x05 (Write Single Coil)
Reference Number: 0x0064 (Register Address)
Data: 0xff00 (ON command)
When you send this packet over the network to port 502 of 127.0.0.1 (let’s imagine this is the PLC's IP), the device doesn't ask, 'Who are you?' It simply says, 'Okay, I've turned on relay number 100.' This is exactly where the danger begins.
Shodan: Searching for a Factory on Google
Attackers no longer need to physically break into a factory to infiltrate it. A PLC or an HMI (Human-Machine Interface) panel accidentally exposed to the internet is just a Shodan search away.
From a Red Teamer's perspective, analyzing the output of a command like this during the reconnaissance phase changes everything:
nmap -sV -Pn -p 502 --script modbus-discover 127.0.0.1
This command doesn't just tell us the port is open; it gives us the device model, firmware version, and sometimes even the project name. If testCompany is a power plant and we can access this information over the internet, that plant no longer belongs to them—it belongs to the internet.
Saying 'Hello' to a PLC with Python (For Educational Purposes)
If you're on the defensive side, you need to know how easily an attacker can move. With libraries like pymodbus, a script can be written in seconds. The following code is purely for educational purposes and demonstrates how a simple command is sent to a local test environment.