modicon-info.nse

local bin = require "bin"
local nmap = require "nmap"
local shortport = require "shortport"
local stdnse = require "stdnse"
local string = require "string"
local table = require "table"

description = [[
Modicon is a brand of Programmable Logic Controller (PLC) that is put out by
Schneider Electric. This NSE is designed to use Modbus to communicate to the 
PLC via Normal queries that are performed via engineering software. The information
that is collected via Modbus is done in two separate function codes. First, Function 
Code 43 is utilized to pull the Vendor Name, Network Module, and the Firmware Version.
Second, Schneider uses function code 90 for communications as well. Via Function Code 90
it is possible to pull information such as the CPU Module, Memory Card Model, and some 
information about the project that is loaded into the PLC. 


http:https://digitalbond.com
]]
---
-- @usage
-- nmap --script modicon-info -p 502 <host>
--
--
-- @output
--502/tcp open  Modbus
--| modicon-info:
--|   Vendor Name: Schneider Electric
--|   Network Module: BMX NOE 0100
--|   CPU Module: BMX P34 2000
--|   Firmware: V2.60
--|   Memory Card: BMXRMS008MP
--|   Project Information: Project -  V4.0
--|   Project File Name: Project.STU
--|   Project Revision: 0.0.9 
--|_  Project Last Modified: 7/11/2013 5:55:33
-- @xmloutput
--<elem key="Vendor Name">Schneider Electric</elem>
--<elem key="Network Module">BMX NOE 0100</elem>
--<elem key="CPU Module">BMX P34 2000</elem>
--<elem key="Firmware">V2.60</elem>
--<elem key="Memory Card">BMXRMS008MP</elem>
--<elem key="Project Information">Project -  V4.0</elem>
--<elem key="Project File Name">Project.STU</elem>
--<elem key="Project Revision">0.0.9</elem>
--<elem key="Project Last Modified">7/11/2013 5:55:33</elem>

author = "Stephen Hilt (Digital Bond)"
license = "Same as Nmap--See http:https://nmap.org/book/man-legal.html"
categories = {"discovery", "intrusive","digitalbond"}

--
-- Function to define the portrule as per nmap standards
--
--
--
portrule = shortport.portnumber(502, "tcp")

---
--  Function to trim white space off the beginning and ending of a string
-- 
-- @param s a string passed in that needs white space trimmed off
function trim(s)
  -- remove white spaces from beginning and ending of the string
  return (s:gsub("^%s*(.-)%s*$", "%1"))
end
---
--  Function to set the nmap output for the host, if a valid Modbus packet
--  is received then the output will show that the port as Modbus.
-- 
-- @param host Host that was passed in via nmap
-- @param port port that Modbus is running on (Default TCP/502)
function set_nmap(host, port)

  --set port Open
  port.state = "open"
  -- set version name to Modbus
  port.version.name = "Modbus"
  nmap.set_port_version(host, port)
  nmap.set_port_state(host, port, "open")

end
---
--  Function to setup the communications to the Modicon. This is where alot
--  of the function code 90 information is sent and parsed for information
--  about the Modicon itself. 
--
-- @param socket Socket passed in via Action to communicate to remote device
-- @param output The output table to add information that is collected
---
function init_comms(socket, output)

  -- decelerations
  local pos
  local payload = bin.pack("H","000100000004005a0002")
  socket:send(payload)
  -- recv packet, however not going to do anything with it
  local rcvstatus, response = socket:receive() 
  -- send and receive, not going to do anything with this packet. 
  payload = bin.pack("H","000200000005005a000100")
  socket:send(payload)
  local rcvstatus, response = socket:receive() 
  -- create a string with 249 T (0x54)
  local count = 0
  local ice = "54"
  while (count < 248) do 
    ice = ice .. "54"
	count = count + 1
  end
  -- send packet with 249 T's (0x54), recv packet and do nothing as well
  payload = bin.pack("H","0003000000fe005a00fe00" .. ice)
  socket:send(payload)
  local rcvstatus, response = socket:receive() 
  -- send packet that request the project information
  payload = bin.pack("H","000400000005005a000300")
  socket:send(payload)
  local rcvstatus, response = socket:receive() 
  -- unpack the Project Name, this is configured by the engineers
  local pos, project_name = bin.unpack("z", response, 50)
  -- unpack the year that the project was last modified
  -- define the next sections we are going to unpack 
  -- Each one is to support time stamp
  local project_hour
  local project_min
  local project_sec
  local project_month
  local project_day
  -- define the 3 vars for the project revision number
  local project_rev_1
  local project_rev_2
  local project_rev_3
  -- unpack the time stamp, as well as the revision numbers
  -- unpack the seconds
  pos, project_sec = bin.unpack("C", response, 38)
  -- unpack the min
  pos, project_min = bin.unpack("C", response, pos)
  -- unpack the hour
  pos, project_hour = bin.unpack("C", response, pos)
  -- unpack the day
  pos, project_day = bin.unpack("C", response, pos)
  -- unpack the month
  pos, project_month = bin.unpack("C", response, pos)
  pos, project_year = bin.unpack("<S", response, pos)
  -- The next 3 are for the revision number
  pos, project_rev_1 = bin.unpack("C", response, pos )
  pos, project_rev_2 =  bin.unpack("C", response, pos)
  pos, project_rev_3 =  bin.unpack("C", response, pos)
  
  
  payload = bin.pack("H","000500000005005a000304")
  socket:send(payload)
  local rcvstatus, response = socket:receive() 
	
  payload = bin.pack("H","000600000004005a0004")
  socket:send(payload)
  local rcvstatus, response = socket:receive() 
	
  payload = bin.pack("H","000700000005005a000100")
  socket:send(payload)
  local rcvstatus, response = socket:receive() 
	
  payload = bin.pack("H","0008000000fe005a000a00000102030405060708090a0b0c0d0e0f10111213141516" .. 
    "1718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f40414243" ..
	"4445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f70" ..
	"7172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d" ..
	"9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9ca" ..
	"cbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8")
  socket:send(payload)
  local rcvstatus, response = socket:receive() 
	
  payload = bin.pack("H","000900000004005a0004")
  socket:send(payload)
  local rcvstatus, response = socket:receive() 
	
  payload = bin.pack("H","000a00000004005a0004")
  socket:send(payload)
  local rcvstatus, response = socket:receive() 
	
  payload = bin.pack("H","000b00000004005a0004")
  socket:send(payload)
  local rcvstatus, response = socket:receive() 
	
  payload = bin.pack("H","000c0000000d005a0020001300000000006400")
  socket:send(payload)
  local rcvstatus, response = socket:receive() 
	
  payload = bin.pack("H","000d0000000d005a0020001300640000009c00")
  socket:send(payload)
  local rcvstatus, response = socket:receive() 
	
  payload = bin.pack("H","000e0000000d005a0020001400000000006400")
  socket:send(payload)
  local rcvstatus, response = socket:receive() 
	
  payload = bin.pack("H","000f0000000d005a002000140064000000f600")
  socket:send(payload)
  local rcvstatus, response = socket:receive() 
  local pos, size = bin.unpack("C", response, 6)
  -- calcualate size of packet, from the starting point we will be reading
  local project_info = ""
  local tmp_proj_info
  local pos 
  -- for loop that iterates at byte 180 to the end of the packet 
  -- the size of the packet is off by 6 since the length field is 6 bytes
  -- into the packet
  for pos=180,size+6 do
	-- if pos is equal to nil or 0x00 
	pos, tmp_proj_info = bin.unpack("A", response, pos)
	if (tmp_proj_info == nil or stdnse.tohex(tmp_proj_info) == "00") then
	  pos = pos + 1
	  project_info = project_info .. " "
	-- else store results
	else
	  project_info = project_info  ..  tmp_proj_info
	end
  end
  -- define and unpack the project file name
  local project_fn
  payload = bin.pack("H","00100000000d005a00200014005a010000f600")
  socket:send(payload)
  local rcvstatus, response = socket:receive() 
  -- parse the project filename
  pos, project_fn = bin.unpack("z", response, 14)
  -- if nil then set some value, other wise we will have issues concatenating strings
  if(project_fn == nil) then
	project_fn = ""
  end
  -- store information into the output table to be shown in nmap results  
  output["Project Information"] = project_name .. " - " .. trim(project_info) .. project_fn
  output["Project Revision"] =  project_rev_3 .. "." .. project_rev_2 .. "." .. project_rev_1
  output["Project Last Modified"] = project_month .. "/" .. project_day .. "/" .. project_year .. 
    " " .. project_hour .. ":" .. project_min .. ":" .. project_sec
  -- return output
  return output
  	
end

---
--  Action Function that is used to run the NSE. This function will send the initial query to the
--  host and port that were passed in via nmap. The initial response is parsed to determine if host
--  is a Modbus/Modicon device. If it is then more actions are taken to gather extra information.
-- 
-- @param host Host that was scanned via nmap
-- @param port port that was scanned via nmap
action = function(host,port)
  -- Function code 43 (0x2b), read device identification (14 - 0x0e)
  local modbus_req_ident = bin.pack("H","000000000005002b0e0200")
  -- Function Code 90 (0x5a) request CPU and Request Memory
  local modbus_req_cpu = bin.pack("H","000100000004005a0002")
  local modbus_req_mem = bin.pack("H","01bf00000005005a000606")
  -- create new output table in Nmap format  
  local output = stdnse.output_table()
  local revision = nil
   -- create new socket
  socket = nmap.new_socket()
  
  -- define the catch of the try statement
  catch = function()
    socket:close()
  end
  -- create new try
  try = nmap.new_try(catch)
  
  -- connect to port on host
  try(socket:connect(host, port))
  -- initialise communications
  -- send read device identification
  try(socket:send(modbus_req_ident))
  local rcvstatus, response = socket:receive()
  if(rcvstatus == false) then
    return false, response
  end
  local pos, status = bin.unpack("C", response, 9) 
  if (status == 0x07) then
    set_nmap(host, port)
	return "\n\tUnknown Exception Code"
  end
  -- parse out the number of responses 
  local pos, numresponses = bin.unpack("C", response, 14)
  if (numresponses == 0x03) then
    set_nmap(host, port)
    local pos, size = bin.unpack("C", response, 16)
	pos, output["Vendor Name"] = bin.unpack("A" .. size, response, 17)
	pos, size = bin.unpack("C", response, pos + 1) 
	pos, output["Network Module"] = bin.unpack("A" .. size, response, pos) 
	pos, size = bin.unpack("C", response, pos + 1)
	pos, revision = bin.unpack("A" .. size, response, pos)
	if (string.sub(output["Vendor Name"], 1, 9) == "Schneider") then
	  
	  try(socket:send(modbus_req_cpu))
      local rcvstatus, response = socket:receive()
      if(rcvstatus == false) then
        return false, response
      end
	  local pos, status = bin.unpack("C", response, 9)
	  if (status == 0x01) then
	    output["Firmware"] = revision
	    return output
	  end
	  pos, size = bin.unpack("C", response, 33) 
	  pos, output["CPU Module"] = bin.unpack("A" .. size, response, pos) 
	  output["Firmware"] = revision
	  
	  try(socket:send(modbus_req_mem))
	  local rcvstatus, response = socket:receive()
      if(rcvstatus == false) then
        return false, response
      end
	  pos, size = bin.unpack("C", response, 17)
	  if(size ~= nil) then
	    pos, output["Memory Card"] = bin.unpack("A" .. size, response, pos)
	  end
	  output = init_comms(socket, output)
	  --output = read_ladder(socket, output)
	  socket:close()
	  -- for each element in the table, if it is nil, then remove the information from the table
      for key, value in pairs(output) do
        if(string.len(output[key]) == 0) then
          output[key] = nil
        end
      end
	  
	  return output
	else
	  socket:close()
	  return nil
	end
  else
    socket:close()
	return nil
  end
end