IEC104 Client for Metasploit #10386

michaelj0hn · 2018-07-27T09:51:30Z

IEC104 Client for Metasploit

IEC 60870 part 5 is one of the IEC 60870 set of standards which define systems used for telecontrol (supervisory control and data acquisition) in electrical engineering and power system automation applications. Part 5 provides a communication profile for sending basic telecontrol messages between two systems, which uses permanent directly connected data circuits between the systems. The IEC Technical Committee 57 (Working Group 03) have developed a protocol standard for telecontrol, teleprotection, and associated telecommunications for electric power systems. The result of this work is IEC 60870-5. Five documents specify the base IEC 60870-5:

IEC 60870-5-104 (IEC 104) protocol is an extension of IEC 101 protocol with the changes in transport, network, link & physical layer services to suit the complete network access. The standard uses an open TCP/IP interface to network to have connectivity to the LAN (Local Area Network) and routers with different facility (ISDN, X.25, Frame relay etc.) can be used to connect to the WAN (Wide Area Network). Application layer of IEC 104 is preserved same as that of IEC 101 with some of the data types and facilities not used. There are two separate link layers defined in the standard, which is suitable for data transfer over Ethernet & serial line (PPP - Point-to-Point Protocol). The control field data of IEC104 contains various types of mechanisms for effective handling of network data synchronization.

Verification

List the steps needed to make sure this thing works

Start msfconsole
use auxiliary/client/iec104/iec104
Set RHOST <TARGET>, replacing <TARGET> with the IP address you wish to attack.
Verify that you see below when you send the command of show options

msf auxiliary(client/iec104/iec104) > show options

Module options (auxiliary/client/iec104/iec104):

   Name                Current Setting  Required  Description
   ----                ---------------  --------  -----------
   ASDU_ADDRESS        1                yes       Common Address of ASDU
   COMMAND_ADDRESS     0                yes       Command Address / IOA Address
   COMMAND_TYPE        100              yes       Command Type
   COMMAND_VALUE       20               yes       Command Value
   ORIGINATOR_ADDRESS  0                yes       Originator Address
   RHOST                                yes       The target address
   RPORT               2404             yes       The target port (TCP)


Auxiliary action:

   Name          Description
   ----          -----------
   SEND_COMMAND  Send command to device

Verify that you see similar below when you send the command of run

[+] 127.0.0.1:2404 - Recieved STARTDT_ACT
[*] 127.0.0.1:2404 - Sending 104 command
[+] 127.0.0.1:2404 -   Parsing response: Interrogation command (C_IC_NA_1)
[+] 127.0.0.1:2404 -     TX: 0002 RX: 0000
[+] 127.0.0.1:2404 -     CauseTx: 07 (Activation Confirmation)
[+] 127.0.0.1:2404 -   Parsing response: Single point information (M_SP_NA_1)
[+] 127.0.0.1:2404 -     TX: 0002 RX: 0002
[+] 127.0.0.1:2404 -     CauseTx: 14 (Inrogen)
[+] 127.0.0.1:2404 -     IOA: 1 SIQ: 0x00
[+] 127.0.0.1:2404 -     IOA: 2 SIQ: 0x00
[+] 127.0.0.1:2404 -     IOA: 3 SIQ: 0x01
[+] 127.0.0.1:2404 -     IOA: 4 SIQ: 0x00
[+] 127.0.0.1:2404 -   Parsing response: Single point information (M_SP_NA_1)
[+] 127.0.0.1:2404 -     TX: 0002 RX: 0004
[+] 127.0.0.1:2404 -     CauseTx: 14 (Inrogen)
[+] 127.0.0.1:2404 -     IOA: 7 SIQ: 0x00
[+] 127.0.0.1:2404 -   Parsing response: Double point information (M_DP_NA_1)
[+] 127.0.0.1:2404 -     TX: 0002 RX: 0006
[+] 127.0.0.1:2404 -     CauseTx: 14 (Inrogen)
[+] 127.0.0.1:2404 -     IOA: 6 SIQ: 0x02
[+] 127.0.0.1:2404 -   Parsing response: Interrogation command (C_IC_NA_1)
[+] 127.0.0.1:2404 -     TX: 0002 RX: 0008
[+] 127.0.0.1:2404 -     CauseTx: 0a (Termination Activation)
[*] 127.0.0.1:2404 - operation ended
[*] 127.0.0.1:2404 - Terminating Connection
[+] 127.0.0.1:2404 - Recieved STOPDT_ACT
[*] Auxiliary module execution completed
msf auxiliary(client/iec104/iec104) >

Document : (https://github.com/michaelj0hn/metasploit-framework/blob/iec104/documentation/modules/auxiliary/client/iec104/iec104.md)

Install

Create a new folder for the IEC104 module, place script in new folder

mkdir -p $HOME/.msf4/modules/auxiliary/client/iec104
cp iec104.rb $HOME/.msf4/modules/auxiliary/client/iec104/

Usage

Selection of module in msfconsole

msf > use auxiliary/client/iec104/iec104

Show module options

msf auxiliary(client/iec104/iec104) > show options

Module options (auxiliary/client/iec104/iec104):

   Name                Current Setting  Required  Description
   ----                ---------------  --------  -----------
   ASDU_ADDRESS        1                yes       Common Address of ASDU
   COMMAND_ADDRESS     0                yes       Command Address / IOA Address
   COMMAND_TYPE        100              yes       Command Type
   COMMAND_VALUE       20               yes       Command Value
   ORIGINATOR_ADDRESS  0                yes       Originator Address
   RHOST                                yes       The target address
   RPORT               2404             yes       The target port (TCP)


Auxiliary action:

   Name          Description
   ----          -----------
   SEND_COMMAND  Send command to device

Usage Examples

Example of sending IEC104 general interrogation command
This is using thde default setting for command type, address and value, this is connecting to an local IEC104 server simulator for demo purposes

msf auxiliary(client/iec104/iec104) > set rhost 127.0.0.1
rhost => 127.0.0.1
msf auxiliary(client/iec104/iec104) > run

[+] 127.0.0.1:2404 - Recieved STARTDT_ACT
[*] 127.0.0.1:2404 - Sending 104 command
[+] 127.0.0.1:2404 -   Parsing response: Interrogation command (C_IC_NA_1)
[+] 127.0.0.1:2404 -     TX: 0002 RX: 0000
[+] 127.0.0.1:2404 -     CauseTx: 07 (Activation Confirmation)
[+] 127.0.0.1:2404 -   Parsing response: Single point information (M_SP_NA_1)
[+] 127.0.0.1:2404 -     TX: 0002 RX: 0002
[+] 127.0.0.1:2404 -     CauseTx: 14 (Inrogen)
[+] 127.0.0.1:2404 -     IOA: 1 SIQ: 0x00
[+] 127.0.0.1:2404 -     IOA: 2 SIQ: 0x00
[+] 127.0.0.1:2404 -     IOA: 3 SIQ: 0x01
[+] 127.0.0.1:2404 -     IOA: 4 SIQ: 0x00
[+] 127.0.0.1:2404 -   Parsing response: Single point information (M_SP_NA_1)
[+] 127.0.0.1:2404 -     TX: 0002 RX: 0004
[+] 127.0.0.1:2404 -     CauseTx: 14 (Inrogen)
[+] 127.0.0.1:2404 -     IOA: 7 SIQ: 0x00
[+] 127.0.0.1:2404 -   Parsing response: Double point information (M_DP_NA_1)
[+] 127.0.0.1:2404 -     TX: 0002 RX: 0006
[+] 127.0.0.1:2404 -     CauseTx: 14 (Inrogen)
[+] 127.0.0.1:2404 -     IOA: 6 SIQ: 0x02
[+] 127.0.0.1:2404 -   Parsing response: Interrogation command (C_IC_NA_1)
[+] 127.0.0.1:2404 -     TX: 0002 RX: 0008
[+] 127.0.0.1:2404 -     CauseTx: 0a (Termination Activation)
[*] 127.0.0.1:2404 - operation ended
[*] 127.0.0.1:2404 - Terminating Connection
[+] 127.0.0.1:2404 - Recieved STOPDT_ACT
[*] Auxiliary module execution completed
msf auxiliary(client/iec104/iec104) >

Example sending switching command
IOA address to be switched is "5", the command type is a double command "46", command is for switching off without time value "5"
Using local IEC 104 server simulator

msf auxiliary(client/iec104/iec104) > set rhost 127.0.0.1
rhost => 127.0.0.1
msf auxiliary(client/iec104/iec104) > set command_address 5
command_address => 5
msf auxiliary(client/iec104/iec104) > set command_type 46
command_type => 46
msf auxiliary(client/iec104/iec104) > set command_value 5
command_value => 5
msf auxiliary(client/iec104/iec104) > run

[+] 127.0.0.1:2404 - Recieved STARTDT_ACT
[*] 127.0.0.1:2404 - Sending 104 command
[+] 127.0.0.1:2404 -   Parsing response: Double command (C_DC_NA_1)
[+] 127.0.0.1:2404 -     TX: 0002 RX: 0000
[+] 127.0.0.1:2404 -     CauseTx: 07 (Activation Confirmation)
[+] 127.0.0.1:2404 -     IOA: 5 DCO: 0x05
[+] 127.0.0.1:2404 -   Parsing response: Single point information with time (M_SP_TB_1)
[+] 127.0.0.1:2404 -     TX: 0002 RX: 0002
[+] 127.0.0.1:2404 -     CauseTx: 03 (Spontaneous)
[+] 127.0.0.1:2404 -     IOA: 3 SIQ: 0x00
[+] 127.0.0.1:2404 -     Timestamp: 2018-03-30 21:39:52.930
[+] 127.0.0.1:2404 -   Parsing response: Double command (C_DC_NA_1)
[+] 127.0.0.1:2404 -     TX: 0002 RX: 0004
[+] 127.0.0.1:2404 -     CauseTx: 0a (Termination Activation)
[+] 127.0.0.1:2404 -     IOA: 5 DCO: 0x05
[*] 127.0.0.1:2404 - operation ended
[*] 127.0.0.1:2404 - Terminating Connection
[+] 127.0.0.1:2404 - Recieved STOPDT_ACT
[*] Auxiliary module execution completed
msf auxiliary(client/iec104/iec104) >

michaelj0hn · 2018-07-27T13:09:21Z

@wvu-r7 this is the updated version of IEC104 Client for Metasploit #10380. It seems the module passed all the checks. How do we proceed after this step?

wvu · 2018-07-27T15:22:29Z

Cool, thank you! All we need to do now is review and testing, and then we can get this merged.

busterb · 2018-07-31T23:22:37Z

modules/auxiliary/client/iec104/iec104.rb

+
+  # creates and STARTDT Activation frame -> answer should be a STARTDT confirmation
+  def startcon
+    apci_data = "\x68"


Prefer << over +=. One appends, the other makes a whole new string.

If you run 'rubocop' on this file, it should highlight most of them.

busterb · 2018-07-31T23:23:57Z

modules/auxiliary/client/iec104/iec104.rb

+    response = send_frame(stopcon)
+    if response.nil?
+      print_error("Terminating Connection")
+    return


indentation (also, rubocop will highlight this)

busterb · 2018-07-31T23:25:09Z

I found a few code nits, but these can also automatically be highlighted by the rubocop tool. Would suggest running that and fixing the reasonable suggestions that it produces (I usually aim for getting it under 10 or so complaints)

This commit incorporates suggested formatting changes based on feedback and rubocop tool run: Corrected indentation issues Using "<<" instead of "+=" for string append Modified if/else branches as per tool suggestion

michaelj0hn · 2018-08-03T18:31:41Z

Thanks for the suggestions! I have now made the requested amendments.
Also, the rubocop list of complaints is now down to 10.

busterb · 2018-08-04T12:45:32Z

Release Notes

A IEC104 client protocol module is now available. It implements a control standard used for telecontrol (supervisory control and data acquisition) in electrical engineering and power system automation applications.

busterb · 2018-08-04T12:45:39Z

Thanks @michaelj0hn

can · 2018-08-06T13:30:22Z

Congratz! @michaelj0hn

iec104 client

09320ec

michaelj0hn mentioned this pull request Jul 27, 2018

IEC104 Client for Metasploit #10380

Closed

6 tasks

michaelj0hn added 6 commits July 27, 2018 13:43

msftidy fix

5435c7a

msftidy 90-91

07896b0

msftidy 90-91-2

da13637

msftidy558

44c1fa9

msftidy 538

4e42834

msftidy-final

7b5e846

added definition of IEC104

7bbb444

busterb reviewed Jul 31, 2018

View reviewed changes

busterb added module feature labels Aug 1, 2018

Amended code formating

dc2f893

This commit incorporates suggested formatting changes based on feedback and rubocop tool run: Corrected indentation issues Using "<<" instead of "+=" for string append Modified if/else branches as per tool suggestion

busterb self-assigned this Aug 4, 2018

busterb merged commit dc2f893 into rapid7:master Aug 4, 2018

busterb added a commit that referenced this pull request Aug 4, 2018

Land #10386, Add IEC104 client module

78f6698

msjenkins-r7 pushed a commit that referenced this pull request Aug 4, 2018

Land #10386, Add IEC104 client module

b42cf88

michaelj0hn deleted the iec104 branch August 6, 2018 10:29

tdoan-r7 added the rn-enhancement release notes enhancement label Aug 15, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

IEC104 Client for Metasploit #10386

IEC104 Client for Metasploit #10386

michaelj0hn commented Jul 27, 2018 •

edited by busterb

Loading

michaelj0hn commented Jul 27, 2018 •

edited

Loading

wvu commented Jul 27, 2018

busterb Jul 31, 2018

busterb Jul 31, 2018

busterb commented Jul 31, 2018

michaelj0hn commented Aug 3, 2018

busterb commented Aug 4, 2018 •

edited by tdoan-r7

Loading

busterb commented Aug 4, 2018

can commented Aug 6, 2018

IEC104 Client for Metasploit #10386

IEC104 Client for Metasploit #10386

Conversation

michaelj0hn commented Jul 27, 2018 • edited by busterb Loading

Verification

Install

Usage

Selection of module in msfconsole

Show module options

Usage Examples

michaelj0hn commented Jul 27, 2018 • edited Loading

wvu commented Jul 27, 2018

busterb Jul 31, 2018

Choose a reason for hiding this comment

busterb Jul 31, 2018

Choose a reason for hiding this comment

busterb commented Jul 31, 2018

michaelj0hn commented Aug 3, 2018

busterb commented Aug 4, 2018 • edited by tdoan-r7 Loading

Release Notes

busterb commented Aug 4, 2018

can commented Aug 6, 2018

michaelj0hn commented Jul 27, 2018 •

edited by busterb

Loading

michaelj0hn commented Jul 27, 2018 •

edited

Loading

busterb commented Aug 4, 2018 •

edited by tdoan-r7

Loading