Industrial Control Systems : Pentesting PLCs 101 (Part 2/2)
summary
Hands-on demo uses MBTget, a Metasploit Modbus client auxiliary module, plcscan, Snap7 Python scripts and Wireshark against a Schneider M340 and Siemens S7‑1200 lab. Finds hardcoded FTP creds in a Java applet, shows Nmap scans can crash fragile TCP/IP stacks, and exploits an unauthenticated stop/start via function 0x5A plus an unauthenticated file download that yields an .apx project which is repackaged and opened in Unity to reveal source. Shows writes to coils/registers working and recommends segmentation, patching, disabling unused services and monitoring.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 0:10Metasploit Console
- 7:10Live Tests
- 9:57Nmap
- 15:49PLC Scan
- 18:59SNMP
- 22:37Web Interface
- 30:04Schneider
- 30:34Siemens
- 38:04Other options
- 48:04Conclusion
related talks
21mOops, It Halted Again: Exploiting PLC Memory for Fun and Profit in Industrial Control...
30mPractical Attack Vectors and Their Ideal Defensive Strategies for ICS & SCADA
50mDead Man’s PLC: Ransoming the Physical World via Operational Technology
40mHacking Mitsubishi PLC Without Access To Firmware
44mRogue7: Rogue Engineering-Station Attacks on S7 Simatic PLCs
29mFuzzing and Breaking Security Functions of SIMATIC PLCs
19mIoT Security Exposed: From PLC Flaws to the Imperative of SBOM
45mLet’s Play a Game – Challenges...