https://github.com/qq1209759648/smod-1
#smod smod是一个模块化框架，具有渗透到modbus协议所需的各种诊断和攻击功能。它是使用Python和Scapy的完整Modbus协议实现。该软件可以在python 2.7.x下的Linux / OSX上运行。
随时提出请求，如果您觉得我们可以做得更好。
近年来，基于SCADA（过程控制网络）的系统已从专有的封闭式网络逐渐转移到开源解决方案和支持TCP / IP的网络。这使他们容易遭受传统计算机网络面临的相同安全漏洞。
Modbus / TCP协议用作参考协议，以显示测试台对电力系统协议进行网络攻击的有效性。选择Modbus / TCP是出于以下原因：
Modbus仍广泛用于电力系统。
modbus / TCP简单易实现。
实用程序可以免费使用modbus协议库，以实现智能电网应用程序。
您可以使用此工具对Modbus协议进行漏洞评估。
## Demo只是一个演示基本内容的演示
root@kali:~/smod# python smod.py _______ < SMOD > ------- \ ^__^ \ (xx)\_______ (__)\ )\/\ U ||----w | || || --=[MODBUS Penetration Test FrameWork --+--=[Version : 1.0.2 --+--=[Modules : 14 --+--=[Coder : Farzin Enddo --=[github : www.github.com/enddoSMOD >help Command Description ------- ----------- back Move back from the current context exit Exit the console exploit Run module help Help menu show Displays modules of a given type, or all modules set Sets a variable to a value use Selects a module by name SMOD >show modules Modules Description ------- ----------- modbus/dos/galilRIO DOS Galil RIO-47100 modbus/dos/writeSingleCoils DOS With Write Single Coil Function modbus/dos/writeSingleRegister DOS Write Single Register Function modbus/function/readCoils Fuzzing Read Coils Function modbus/function/readDiscreteInput Fuzzing Read Discrete Inputs Function modbus/function/readExceptionStatus Fuzzing Read Exception Status Function modbus/function/readHoldingRegister Fuzzing Read Holding Registers Function modbus/function/readInputRegister Fuzzing Read Input Registers Function modbus/function/writeSingleCoils Fuzzing Write Single Coil Function modbus/function/writeSingleRegister Fuzzing Write Single Register Function modbus/scanner/discover Check Modbus Protocols modbus/scanner/getfunc Enumeration Function on Modbus modbus/scanner/uid Brute Force UID modbus/sniff/arp Arp PoisoningSMOD >
蛮力Modbus UID
SMOD >use modbus/scanner/uidSMOD modbus(uid) >show options Name Current Setting Required Description ---- --------------- -------- ----------- Function 1 False Function code, Defualt:Read Coils. Output True False The stdout save in output directory RHOSTS True The target address range or CIDR identifier RPORT 502 False The port number for modbus protocol Threads 1 False The number of concurrent threads SMOD modbus(uid) >set RHOSTS 192.168.1.6SMOD modbus(uid) >exploit [+] Module Brute Force UID Start[+] Start Brute Force UID on : 192.168.1.6[+] UID on 192.168.1.6 is : 10SMOD modbus(uid) >
Modbus的枚举功能
SMOD >use modbus/scanner/getfuncSMOD modbus(getfunc) >show options Name Current Setting Required Description ---- --------------- -------- ----------- Output True False The stdout save in output directory RHOSTS True The target address range or CIDR identifier RPORT 502 False The port number for modbus protocol Threads 1 False The number of concurrent threads UID None True Modbus Slave UID. SMOD modbus(getfunc) >set RHOSTS 192.168.1.6SMOD modbus(getfunc) >set UID 10SMOD modbus(getfunc) >exploit [+] Module Get Function Start[+] Looking for supported function codes on 192.168.1.6[+] Function Code 1(Read Coils) is supported.[+] Function Code 2(Read Discrete Inputs) is supported.[+] Function Code 3(Read Multiple Holding Registers) is supported.[+] Function Code 4(Read Input Registers) is supported.[+] Function Code 5(Write Single Coil) is supported.[+] Function Code 6(Write Single Holding Register) is supported.[+] Function Code 7(Read Exception Status) is supported.[+] Function Code 8(Diagnostic) is supported.[+] Function Code 15(Write Multiple Coils) is supported.[+] Function Code 16(Write Multiple Holding Registers) is supported.[+] Function Code 17(Report Slave ID) is supported.[+] Function Code 20(Read File Record) is supported.[+] Function Code 21(Write File Record) is supported.[+] Function Code 22(Mask Write Register) is supported.[+] Function Code 23(Read/Write Multiple Registers) is supported.SMOD modbus(getfunc) >
模糊读取线圈功能
SMOD >use modbus/function/readCoilsSMOD modbus(readCoils) >show options Name Current Setting Required Description ---- --------------- -------- ----------- Output True False The stdout save in output directory Quantity 0x0001 True Registers Values. RHOSTS True The target address range or CIDR identifier RPORT 502 False The port number for modbus protocol StartAddr 0x0000 True Start Address. Threads 1 False The number of concurrent threads UID None True Modbus Slave UID. SMOD modbus(readCoils) >set RHOSTS 192.168.1.6SMOD modbus(readCoils) >set UID 10SMOD modbus(readCoils) >exploit [+] Module Read Coils Function Start[+] Connecting to 192.168.1.6[+] Response is :###[ ModbusADU ]### transId = 0x2 protoId = 0x0 len = 0x4 unitId = 0xa###[ Read Coils Answer ]### funcCode = 0x1 byteCount = 1L coilStatus= [0]SMOD modbus(readCoils) >