File modbus-discover

脚本使用类型: portrule
脚本所属分类: discovery, intrusive
脚本下载地址: http://nmap.org/svn/scripts/modbus-discover.nse

User Summary

Enumerates SCADA Modbus slave ids (sids) and collects their device information.

Modbus is one of the popular SCADA protocols. This script does Modbus device information disclosure. It tries to find legal sids (slave ids) of Modbus devices and to get additional information about the vendor and firmware. This script is improvement of modscan python utility written by Mark Bristow.

Information about MODBUS protocol and security issues:

• MODBUS application protocol specification: http://www.modbus.org/docs/Modbus_Application_Protocol_V1_1b.pdf
• Defcon 16 Modscan presentation: https://www.defcon.org/images/defcon-16/dc16-presentations/defcon-16-bristow.pdf
• Modscan utility is hosted at google code: http://code.google.com/p/modscan/

Script Arguments

aggressive

- boolean value defines find all or just first sid

Example Usage

执行格式

nmap --script modbus-discover.nse --script-args='modbus-discover.aggressive=true' -p 502 <host>

Script Output

PORT    STATE SERVICE
502/tcp open  modbus
| modbus-discover:
|   Positive response for sid = 0x64
|     SLAVE ID DATA: \xFA\xFFPM710PowerMeter
|     DEVICE IDENTIFICATION: Schneider Electric PM710 v03.110
|_  Positive error response for sid = 0x96 (GATEWAY TARGET DEVICE FAILED TO RESPONSE)

Requires

• bin
• comm
• nmap
• shortport
• stdnse
• string
• table

Author: Alexander Rudakov

License: VER007 整理 http://www.ver007.com