CERBERUS/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2026-08-29 13:01:34 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Add OPC UA TCP probe and match

Browse source 
Send HEL message with invalid EndpointURI and expect either ACK or ERR as response [1].
Ports are default ports on popular OPC UA software [2].
Rarity based on gut feeling.

References:
1. https://reference.opcfoundation.org/Core/Part6/v104/docs/7
2. https://claroty.com/team82/research/opc-ua-deep-dive-series-a-one-of-a-kind-opc-ua-exploit-framework
This commit is contained in:
Valtteri Lehtinen 2024-03-02 21:47:54 +02:00
parent b862961cdb
commit 5b518af9f2
1 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
nmap-service-probes
View file

@ -16774,3 +16774,12 @@ ports 34555
Probe UDP BECKHOFF_ADS q|\x03\x66\x14\x71\0\0\0\0\x01\0\0\0\0\0\0\0\x01\x01\x10\x27\0\0\0\0|
rarity 8
ports 48899
##############################NEXT PROBE##############################
# OPC UA TCP HEL message
Probe TCP HelRequest q|\x48\x45\x4c\x46\x37\x00\x00\x00\x00\x00\x00\x00\x00\x20\x00\x00\x00\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x17\x00\x00\x00\x6f\x70\x63\x2e\x74\x63\x70\x3a\x2f\x2f\x6e\x6d\x61\x70\x2e\x6f\x72\x67\x3a\x31\x33\x33\x37|
rarity 6
ports 49320,62541,4897,53530,48050,4885,4840,4855,26543
# Possible OPC UA TCP responses to HEL message
match opc-ua-tcp m|^ACKF|
match opc-ua-tcp m|^ERRF|