From 5b518af9f22c01dbdbe0e7aadccc33e494ea8f4b Mon Sep 17 00:00:00 2001
From: Valtteri Lehtinen <valtteri@shufflingbytes.com>
Date: Sat, 2 Mar 2024 21:47:54 +0200
Subject: [PATCH] Add OPC UA TCP probe and match

Send HEL message with invalid EndpointURI and expect either ACK or ERR as response [1].
Ports are default ports on popular OPC UA software [2].
Rarity based on gut feeling.

References:
1. https://reference.opcfoundation.org/Core/Part6/v104/docs/7
2. https://claroty.com/team82/research/opc-ua-deep-dive-series-a-one-of-a-kind-opc-ua-exploit-framework
---
 nmap-service-probes | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/nmap-service-probes b/nmap-service-probes
index 305cd71f6..8b21557dd 100644
--- a/nmap-service-probes
+++ b/nmap-service-probes
@@ -16774,3 +16774,12 @@ ports 34555
 Probe UDP BECKHOFF_ADS q|\x03\x66\x14\x71\0\0\0\0\x01\0\0\0\0\0\0\0\x01\x01\x10\x27\0\0\0\0|
 rarity 8
 ports 48899
+##############################NEXT PROBE##############################
+# OPC UA TCP HEL message
+Probe TCP HelRequest q|\x48\x45\x4c\x46\x37\x00\x00\x00\x00\x00\x00\x00\x00\x20\x00\x00\x00\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x17\x00\x00\x00\x6f\x70\x63\x2e\x74\x63\x70\x3a\x2f\x2f\x6e\x6d\x61\x70\x2e\x6f\x72\x67\x3a\x31\x33\x33\x37|
+rarity 6
+ports 49320,62541,4897,53530,48050,4885,4840,4855,26543
+
+# Possible OPC UA TCP responses to HEL message
+match opc-ua-tcp m|^ACKF|
+match opc-ua-tcp m|^ERRF|