Modbus Stager: retrieving a payload from a PLC
Channel: Borja Merino
Date: 13/12/2016

Stager to fetch via modbus a payload from a PLC. The code gets the first 4 bytes to know the stage size and to reserve the necessary memory via VirtualAlloc. Then, it get the payload by making successive "read holding" requests (function code 03). 
Finally, the payload is run. A shellcode with keyloger functionality has been used as stage in the video.

More info: http://www.shelliscoming.com/2016/12/modbus-stager-using-plcs-as.html