thank you sean i appreciate the
introduction
and welcome everybody i i haven't talked
at def con in a couple years
and you know this is uh actually it's
been a couple months since i've talked
for
uh the ics village i'm always
appreciative that they
keep inviting me back to talk about some
of the things that i've been working on
and you know providing me with these
opportunities so i give back every
chance that i get
uh if you're is this is your first ics
village
please start to get involved reach out
to them for some of your research
with some of the information volunteer
to talk as well
we want to hear from all of you and i
really appreciate it
uh what i'm here to talk to you about
today is the scripts and tools to help
your ics infosec
journey and this is just going to be
kind of a brief introduction
to how to do some of the things or at
least how i approach
automating some of my tasks
and come up with some of the scripts
that i use to
pull information from devices whether
it's for
security research as i'll keep pointing
over here but
um you know ics village provided me the
schneider electric
modicon m221
program logic controller or plc to do
some of my research on
uh and so when i point down like that
that's what i'm talking about
but whenever i'm doing security research
or i'm going on site to do a security
assessment for somebody
i try to automate things as much as
possible and a lot of times i find out
that i'm doing it
on the fly and so when tom asked me to
give a talk
i couldn't think of any research that i
was doing but i thought about this
helping people
understand how i approach some of my
tool development
and automating some of my processes so
that's what we're going to talk about
who am i i'm don c weber also
known as cutaway i've been doing
information
security since 2002 when i got out of
the marine corps and went back to school
i have been fortunate enough to work on
a lot of
great teams i have a broad background
in information security forensic
incident response
penetration testing security research
and right now i'm doing helping
organizations within the industrial
control
arena to evaluate their programs to
understand doing security assessments
with their within their control
environment uh reviewing their
information
security programs to protect those
environments as well
some of the things that we're going to
be talking about and actually building
towards
are some of the tools that i used during
my assessments and you can see those out
at the cutaway security github
you can see that listed here i'll
highlight it
more specifically we'll at least look at
one script from the cut sect tools
some of the things that i've developed
to gather information and that's my goal
is to help you if you're if you're just
starting out
understanding the thought process for
coming up with something that you can
automate if you want to do some
asset discovery that's one of the tools
that we'll look at if you're
working in this arena and need to gather
information about your assets you know
understanding the firmware of your
devices
what version they're running you can
automate some of that information
gathering and store that off
and make that process repeatable so
that's what we're going to do we're
going
to talk about some of the concepts
around information gathering and
developing a script out of it we'll
develop a script real quick
uh we'll talk about some device
interactions
uh not sure what depends on how fast
we'll go we'll talk about
uh network analysis and then we'll look
at one of the scripts
from the cut set tools all right i'm
going to go pretty fast because i'm
covering only have 25 minutes and we've
got a lot of things to cover
so the first thing i want to do is i
want to open up a terminal i've got
i'm using kali as you can see here it's
a little bit older version but
it will do for what uh um for what we're
working on here
when i get on to a network whether it's
you know talking to
going to converse with a specific
devices management interface
or it's a device out in my clients
environment if i'm on the network i need
to understand
how my network devices are configured so
i'm going to run the ip adder as we can
see i actually want to take off
i want to remove that ip address
so let's go ahead and i believe it's
delete
yeah so i'm going to start
i'm going to start my ip address or my
um my analysis without having an ip
address on my interface
okay i've got two interfaces here this
is a virtual machine so i've got my
ethernet
0 which is bridged with my host
operating system
that would be connected possibly to the
internet and so i don't want to connect
my clients
uh networks to that so i usually go with
a
usb interface as well and that's what
the eth1 is i've got a usb
interface that's attached to this it's
not going to my regular operating system
i can't bridge it to another network it
can only operate on this network
so that's where i start then whenever i
plug
into a device like the the plc that i
have here
i have to understand what the
management interface is looking for i
need to understand what subnet it's on
now i can go through the vendor
documentation and that
is one way to discover it another way is
is to actually query the information
because
our operators and our engineers they can
change the configuration
of those devices those management
interfaces so they might have done
something to keep it from us and that's
what we're going to see here
so one of the things that i start with
is when i connect to a device or to a
subnet i just start
actually the first thing i do let's call
that up real quick
the first thing i do is i start a
wireshark okay and i just start sniffing
on the network
okay and i'm connected directly to a
device so this isn't broadcasting
anything
i might start and stop it see if that
changes if i was on a regular network we
would see
things like address resolution protocol
arp requests
we're going to see a broadcast you know
if it's ethernet if it's some type of
industrial
control protocol like bacnet we're going
to see multiple
devices communicating over broadcast
messages
for that protocol so
i would listen to that to see if i can
glean information understand
the ip addresses and the types of
devices that are out there
in this case we don't have that so we
have to do that our discovery ourselves
let's go ahead and close that in this
case what i want to do is i want to use
arcscan
need to run it as administrator i'm
going to run the arp scan tool
i need to tell it which interface i
wanted to go out which is our ethernet 1
and then i want to tell it which subnet
to look for so i want to identify all of
the devices
the endpoints i need to ask them for
their hardware interface
for this subnet okay and when i run this
command
we can see that it's a you know it's
starts putting out a warning because i
don't have an ip address
on my own interface uh it
tells me what my interface information
about my interface is
but it also says that there are no there
were no responses
to the art requests so in other words uh
this tool sent a bunch of arp requests
for that subnet but nothing returned
well that's because the device has been
configured with a different subnet
when i run it with the 192.168.0 subnet
we can see that something responds in
this case this is the plc
it's been assigned the 0.21
ip address the hardware address
for its interface is this this right
here
and then we can see the manufacturer for
that interface as well
okay this is how i start my assessments
now
as i mentioned the process engineers
they didn't have to
keep the um default you know so this
looks like a default
address you know but they could have
changed that it this very
easily could be in 192.168.50
or 100 and doing
this by hand is really slow
in other words i wouldn't have been able
to find that myself and so i could click
up and
you know i could uh um tab up and and
keep doing this myself
but i want to automate this process and
the way we do that is i mean first
first we need to start by getting rid of
some of that extra information
in other words we had that warning
message
we also had the information about our
interface
we don't need all of that information
okay i've got all that documented now
so what i want to do is i want to
leverage my uh
terminal and some of the things that it
is capable of
i want to redirect the warnings and so
the file handle 2 i can redirect that
into devnow which is like the trashcan
i can also search for the lines that
have the information that i expect
so i should have the information about
the subnet
and if i create change that to zero and
hit enter
now this is gonna run notice i didn't
get any warnings or any other
information i have
nice clean output if there is
no information coming back so like the
one
there's absolutely nothing coming back
so i know have a nice clean
output now remember i want to automate
this
if i don't know the actual subnet if i
wasn't lucky with the first two
uh then i want to come up with a way to
enumerate through all of the subnets and
we do that by
looping through things and so this is
just a command right here
uh leveraging a for loop okay
for i and i is going to be our uh um
a a variable that we um that
we keep information in and we're going
to keep a list of numbers
for zero through five okay and then
we're going to
leverage the dollar sign i and our shell
in this case it's the zsh our shell is
going to replace every dollar sign i
with a number and this is just the
syntax for enumerating
through so zero one two three four five
i could go up to two
uh um 254 because that would be the max
number of subnets
and that's what i want to do but we're
only going to do five here for
speed okay and then you can see we have
our arp scan here and this is our arc
command that we just
um we just talked about i include the
echo here
uh the echo with the um so this is we
understand we need a way to understand
that our command is still running
okay because a lot of times if we don't
have output some of our output might not
happen
and if we don't have something to
display then we might think that it's
frozen
frozen when sometimes it just takes a
lot of time to get a response
and as you can see here i have nice
clean output i can
redirect that into a file and i've got
so i've collected some good information
about this environment
i've created a repeatable process i can
copy and paste this
the command and i can keep this like in
a you know a text document like this
and that way i i always ensure that i
run this command the same way
every time okay and that's great
but i still want to automate it a little
bit further i want to actually come up
with
some type of script and so that's what
we have here so i've
actually got a list so if i look in the
i've already put everything in the arp
scan
so if i cut this out we'll see
that i've just created a script with the
line that the command line that we just
had
uh we have to um it's best if we tell it
which shell to go in
uh our for loop here so iterate through
zero from zero to five
uh our echo this time we want to tell it
specifically where
our um our program is we don't want to
just put our scan
or the arp scan in our script because
now our script is going to check our
path
if we have issues with our path it's
going to break our script and so we
don't want to do that
so really all i did was when i was
writing this i just did a which
arp scan which tells me which
program where the program is actually
located and i just put that in there
now if we run this command we have to
make it executable but if we run this
command
now we can see that output and that's
not what i expected
[Music]
what did i mess up here
that should have run correctly oops
oh
i didn't include pseudo in there and we
definitely don't want to include sudo in
there we want to run
sudo you know and that's a that you know
failure is a uh um
a great tool and i you know whenever i'm
on site
uh whenever i'm doing research uh there
are a lot of times when i do this i
don't get the results back that i
expected
well there could be a reason either i
made a mistake in my script
made a mistake in my command line or i
forgot to run it as administrator and we
can see that here
i ran the script everything went right
went fine
but the error message because i had sent
the error message to deb null
i didn't see that result okay so running
with uh
sudo we can see that now we have output
that we expect to find and that's great
this is exactly what we want
now we have a repeatable process
okay from there
i can just save that out actually
actually after this i should go and
store that
in the cut tech tool so hopefully this
uh um
i'll remember to do that after we're
done here from there that's when i want
to
assign myself or my interface
an address on this network remember we
don't have an address on this network
let's go ahead and go back i'm just
going to scroll up so i write
run the command correctly
so let's add an ip address
to our interface so sudo ipader we want
to be on the
zero subnet so let's give ourselves a
dot two
and when we run the ip adder again we
can see now we have an address on there
and from there we can start looking at
that device
okay and in this case i want to
understand the services that are running
on there for
plc i would expect that they have
management interfaces potentially
on potentially a web server usually an
ftp server but there's always some type
of service running on there
and so what i'm going to do is i'm going
to do an map we have to be
careful with these devices because
they're not like our windows operating
systems our linux operating systems
they don't handle unusual connections
well and nmap does make unusual
connections to see how the endpoint
responds
so we're going to format our
nmap command to make it safe for the
device and we can see
i do want to run it as an administrator
and said well that will help with the um
the output uh we want to don't ping the
device so don't worry about if it
doesn't respond to pings
don't resolve so the dash n is don't
resolve
both the port numbers and the endpoints
the st will be a full tcp
tcp handshake and it will establish the
connection and tear it down
some devices if you just do a sin scan
they will hang
and nothing else can connect to that
until it actually gets a
tear down packet for that connection and
that could be
have a negative
impact on the functionality of that
device
then we're going to look for a specific
we're not going to look for all
top 1000 ports we're only going to look
for something that
for ports that are associated with some
of the management interfaces we expect
we want to start this and we might scale
up
but let's start small so let's go ahead
and do a scan of this
right now and as you can see
it ran we didn't need to throttle this
it went through and it searched all of
those ports and now we can see that it
only has
one service that's running okay and this
is actually i like this it doesn't have
an ftp server on it to
serve up the configuration files but the
only real way to communicate with these
types of devices
you actually have to use a modbus and
its proprietary modbus that's associated
with modicon
and that is what allows the
communication
configuration of the remote com
configuration and management of these
devices
so it actually would have to click over
to my windows system
and run that schneider electric software
to interact with this but certainly now
we could start
interacting uh with the modbus on this
device
i'm not going to get into that you guys
can go out and find some of that learn
how to interact with modbus
actually i've got some videos that are
out there on the sans
ics concepts uh youtube playlist so if
you go out to that you can just search
for
sans ics concepts uh you should should
come up with some of the videos there's
three videos on
modbus enumeration uh analysis and man
in the
machine in the middle attacks so you can
go out there and check that out
uh what we want to do is uh
you know so now i've we want to talk
about
um a more
scripting and information gathering um
i wanted to and i didn't realize how
long i would have i wanted to talk a lot
more about
uh some of the things that i do
associated with
uh information discovery with wireshark
you know let's go through that real
quick let me see if i can open this up
i've gone out to the um control things
website uh and
you can go out there and there's a
repository in the ct samples
and you can download some pcaps of
different protocols and that's what i've
done
i've done i've gone and downloaded the
combined
[Music]
i've looked in the combined folder and
i've downloaded the plant one
pcapp and as you can see here this is
just a
pcap with a lot of different industrial
controls and what i can do here is i can
search on for things like
modbus traffic
okay and this will display this filter
this display filter will filter out
all of the different things that you can
find
within this that are associated with the
modbus protocol
all right and how i script this is
i'll start my analysis here and then
i'll start doing things like
uh searching on destination so i will
destination port so i'll click right
click on destination port and i'll say
prepare as a filter and select it and
then i'll just
search for everything that is
destination port 502
and we can see that this finds all of
the queries so this is just the queries
the client which is requesting
information from a device
that i know that this is a good filter
and then i can go in and i can take this
filter
and i can automate some t-sharp commands
and i can go back to
i can go and locate the actual pcap
and run a command line
oops let me copy it over one time
i can run t shark which will go out and
now i can
set up a filter that will search on
modbus
search just on the destination port 502
so just the requests like we saw in
in wireshark and then i can tell it hey
only split out the two fields i want the
ip
source and the ip destination okay and
then
sort that information and sort it so
that
you remove all of the extra occurrences
and you only provide me with unique
results so that's the sort you
and as we can see here we've got a
modbus client which is a single server
querying a whole bunch of different
devices and so this is how
and what i do is i take this command and
i copy it out and i maintain this so
that i can repeat this
command i don't have to look this up
every single time
and while modbus might be relatively
easily some of the other industrial
protocols get a little bit more complex
for the information gathering like this
and so this is just a valuable way to do
that i'll take
all of this information and i'll take
all of these techniques
and i'll start to
excuse me what i'll do is
i will create scripts so let's go ahead
and i'm going to look in the cutaway
security tools ics
i've created some discover asset scripts
and if we look at this let me make this
a little bit bigger
we can see that i'm i've made a i've
taken python and i've created a python
script
that pool that leverages a python
modbus module
and uh i've configured it so that will
iterate over any subnet that i provided
and that's what we have here so we've
got
a range which is a list of subnets okay
um
i've got some specific devices that i've
gone out and pulled
research from the internet and looked up
their modbus map
actually that's what i was showing you
up here okay
so i went out uh so i went out this is
an example of
a ge device a d60 line distance relay
i've went out and gathered the
instruction manual
i'll search the instruction manual for
the modbus
map and the modbus map for these devices
if you interact with these this ge
device
you can pull things like the serial
number the manufacturer
the modification number ethernet mac
address all of this information is
stored in uh specific locations
within the modbus memory and then you
can go and take that information
and generate a script and as you can see
i've
gone through and looked at the memory
mappings of
several of these ge devices and i've
come up with ways to query
get the ge firmware and we'll go out and
retrieve that information
and bring it back to me and print all of
this information
out and um i can redirect it into a file
and this is one of the ways that i
assist some of my
uh clients with doing asset discovery
within their environment
i did all of this by doing this research
by interacting with the devices
on the command line first figuring out
the important
information uh to grab uh doing
additional research
and then finding ways to script this up
so that it's a repeatable process
all right and that's all i wanted to
show you once again i appreciate
everybody coming out
and i hope that you have a great def con
experience whether you're
in person or you're remote have a great
day
be safe take care and we will talk to
everybody soon