Pwning Modbus/TCP

Well, to be honest, although I'm not talking about specific attacks here, any access to a Modbus/TCP service is effectively a "pwn" in my opinion.

Modbus/TCP has a number of function calls:

• Function code 1 - Read Coils (read-write booleans)
• Function code 2 - Read Discrete Inputs (read-only booleans)
• Function code 3 - Read Holding Registers (read-write integers)
• Function code 4 - Read Input Registers (read-only integers)

Each of these different data types are stored in a different area of memory, according to Modbus, so you can think of the different function codes as different offsets into the data registers of Modbus. For example, if you have a value in register 41001 which you wish to access via Modbus. You first need to work out which function code covers that area of memory. In this case, it is a Holding Register containing a read-write integer, so therefore you need to use Function code 3 to access it. Function code 3 immediately puts you into the 40000-49999 area of memory, so the memory address you need to supply is not 41001, but instead 1000 (as Modbus indexes from 0, register (4)1001 is represented as 1000 on the wire).

If you put it all together, in order to read an integer in register 41001, you need to send a Modbus/TCP read from the Master to the Slave with the Function Code 3 and the memory address 1000. If you use Wireshark, you should be able to see these exact values in the Modbus queries going from the Master to the Slave.