A 'Force Single Coil' request (Function Code 05) in a Modbus TCP packet translates to a valve closing, a motor stopping, or a cooling system being deactivated in the physical world. When you see this raw hex code in network traffic—and it’s not part of scheduled maintenance—the countdown to a physical catastrophe has already begun.
The world of Industrial Control Systems (ICS) and Operational Technology (OT) plays by rules that would make a traditional IT admin's head spin. While we in the IT realm preach 'Confidentiality,' our friends on the OT side are losing sleep over 'Availability' and 'Safety.' Rebooting a database server during a patch is a nuisance; rebooting a PLC (Programmable Logic Controller) could mean $10 million of production going straight to the bin, or worse, a legitimate explosion risk.
The Innocence of Protocols and the Identity Crisis
Most protocols used in the OT world—Modbus, Profinet, EtherNet/IP, BACnet—were designed in the 70s and 80s. Back then, 'security' meant a high fence and a locked gate. Because of this heritage, the vast majority of these protocols have no concept of 'authentication.'
As an attacker, if you've breached the internal network of example.com and reached the OT segment, you don't need a password to tell a PLC to stop. You just need to send the right packet to the right address.
Let’s look at a standard Modbus TCP packet structure (Defanged):
# Modbus TCP Header (MBAP)
Transaction ID: 0x0001
Protocol ID: 0x0000
Length: 0x0006
Unit ID: 0x01
# Modbus PDU
Function Code: 0x05 (Write Single Coil)
Reference Number: 0x0010 (Valve Address)
Data: 0xFF00 (ON/Close)
When you send this packet to a PLC at 127.0.0.1 (local simulation), the PLC will dutifully close that valve without asking any questions. This is exactly why segmentation in an OT network isn't a 'nice-to-have'—it's a 'must-have.'
Is the Purdue Model Just Paperwork?
When we talk about segmentation, the Purdue Model always comes up. That famous pyramid stretching from Level 0 (physical sensors) to Level 5 (enterprise network). But the reality we see in the field is often a 'Flat Network' disaster. In a world where an accounting PC can ping a PLC on the assembly line, the 'air-gap' is nothing more than a myth.
In a real-world Red Team operation, we usually pivot to the OT network via a vulnerability in the corporate network. An Engineering Station with dual NICs (Network Interface Cards) is gold for an attacker. These machines, with one foot in the corporate LAN and the other in the production network, are the most effective bridges we can find.
Discovery: Crashing PLCs with Nmap
In an IT network, running nmap -A -T4 is standard procedure. But if you do that in an OT network, you risk locking up the sensitive TCP stacks of legacy PLCs and halting production. Before the site engineer starts chasing you down with a massive wrench, you need to learn this: in the OT world, passive discovery is king.