Description
Modbus is a cleartext protocol used in common SCADA systems, developed originally as a serial-line (RS232) async protocol, and later transformed to IP, which is called ModbusTCP. default tcp port is 502.
This module sends a command (0x04, read input register) to the modbus endpoint. If this command is sent to the correct unit-id, it returns with the same function-id. if not, it should be added 0x80, so that it sys 0x84, and an exception-code follows which do not interest us. This does not always happen, but at least the first 4 bytes in the return-packet should be exact the same as what was sent.
You can change port, ip and the scan-range for unit-id. There is also added a value - BENICE - to make the scanner sleep a second or more between probes. We have seen installations where scanning too many too fast works like a DoS.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use auxiliary/scanner/scada/modbus/findunitidmsf undefined(findunitid) > show actions ...actions...msf undefined(findunitid) > set ACTION < action-name >msf undefined(findunitid) > show options ...show and set options...msf undefined(findunitid) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub