OT

PENETRATION
TESTING
 AGENDA
• Introduction
• OT Security Importance
• Security Incidents
• Challenges
• Methodology

2
 INTRODUCTION

• Hardware and software systems used to

manage and control industrial
operations and processes.
• Enables automation, data collection,
monitoring, and control of physical
devices and processes in sectors like
manufacturing, energy, and utilities and
many more.
• Key Components are PLC, HMI,
SCADA etc.

3
OT SECURITY PROBLEM
Clear Text protocols, Vulnerable Firmware,
Brittle Services, Insecure Applications.
More than 40% of global ICS systems faced
malicious activity in the second half of 2022 [
DarkReading].
If not secured, adversarial attacks can end up
compromising:
• Operational Continuity
• Human Safety
• National Security
4
NOTABLE SECURITY INCIDENTS
UKRAINE POWER
STUXNET TRITON/TRISIS
GRID ATTACK
• Sophisticated Malware • Coordinated malware • TRITON/TRISIS attack
that targeted Iran's nuclear attacks targeting SCADA targeted a Saudi
facilities. Specifically systems, affecting petrochemical plant.
aimed at Siemens distribution systems and • Aimed at the plant's safety
industrial control systems. causing widespread power systems, attempting to
• Caused significant outages. manipulate the Triconex
damage by disrupting • Left thousands without safety instrumented
centrifuges used for electricity. system (SIS).
uranium enrichment.

5
OT NETWORKS
EVOLUTION
• Integration of IIoT devices.
• More connected than ever.
• New emerging threats.
Air-gapped OT networks are not an
option anymore.
Requires more than IDS/IPS &
monitoring systems.
Penetration testing to check the
resilience of OT Networks?

6
 CHALLENGES
Access Limitations
Legacy Systems
Risk of Disruption
Because of the fragile and weak
nature of OT devices, testing can
potentially disrupt operational processes
leading to downtime or safety risks.

Sample Footer Text 7

 THE PROBLEM & THE GOAL

Problem:
• The biggest problem is not insecure
devices.
• The problem is the insecure deployment
of these devices.
• Flat network topology, worst case
scenario.
Goal:
Goal is not to protect the weak devices.

8
 METHODOLOGY
OT VAPT exercise should include the below high-level activities:

1. Planning and Conducting the technical assessment

2. Prioritizing the observations and vulnerabilities
3. Validating identified vulnerability with evidence.
4. Perform penetration on the agreed assets & OT network infrastructure.
5. Delivering reports with recommendations for the technical and
management teams.
6. Retesting reported vulnerabilities.
7. Final Report and Dashboard submission.

9
 METHODOLOGY
Process Familiarization:
• Architecture Review
• Site Walk Thru
• Physical Security
• Engineer / Operator actions in
process.
• Interviews
• Engineers / Operators
• IT Teams

• Threat Modelling
• Configuration Analysis
10
 METHODOLOGY
Passive Information Gathering:
Monitor Network Communication:
• Hardware: Tap, SPAN Port
• Software: Tcpdump, Dumpcap,
Wireshark,
Zeek.
• Scripts & Offline Analysis
• Configuration Hardening
Assessment Powershell Scripts
Scripts (CHAPS)
• Windows Exploit Suggester Next
Generation
11
 PASSIVE INFORMATION GATHERING
Analyzing packets
for key information:
With the [Link]
Wireshark filter and selecting
a packetWe find out:
Authorization:
Basic YWRtaW46YWRtaW4=

Getting credentials admin:admin by

decoding the basic Hash in
CyberChef.
Also found Authorization: Basic
cm9vdDpyb290, which is root:root.

12
 PASSIVE INFORMATION GATHERING

Analyzing packets
for key information:
Mapped the information gathered so
far:
Asset [Link] is communicating
over HTTP to port 80 on [Link]
using admin:admin as its credentials.
Asset [Link] is communicating
over HTTP to port 80 on [Link]
using root:root as its credentials.

13
 PASSIVE INFORMATION GATHERING

Analyzing
packets
for key
information:
Changed filter to
[Link]==“POS
T”
& selecting a
packet We find out
some interesting
URLs that are
being posted to:
• /goform/svLogin
• /[Link]
• /view/ 14
 PASSIVE INFORMATION GATHERING

Analyzing
packets
for key
information:

By clicking on the
first
/goform/svLogin
POST request and
navigating to the
application/x-
www-form-
urlencoded
section, we can 15
 PASSIVE INFORMATION GATHERING

Analyzing packets
for key information:

We have now found another set of root:dbps credentials.

Jotting down this information, we can now add the following:
• Asset [Link] is communicating over HTTP to port 80 on asset
[Link], which happens to be a Digiboard device using the
root:dbps credentials.

The next packet would be the POST request for /[Link]. If we look at
the packet dissection, we come across a very interesting find, that is,
Cookie, as shown in the following screenshot:

16
 PASSIVE INFORMATION GATHERING
Analyzing packets
for key information:

Here, we can see another set of credentials:

• AccountName508=admin
• Password508=0192023a7bbd73250516f069df18b500
Password looks as though it is encrypted, we can use
hashidentifier.

17
 PASSIVE INFORMATION GATHERING
Analyzing packets
for key information:

Running Command:
echo 0192023a7bbd73250516f069df18b500 | hash-identifier

18
 PASSIVE INFORMATION GATHERING
Analyzing packets
for key information:

Running Command:
echo 0192023a7bbd73250516f069df18b500 | hash-identifier
We have now found another set of admin:admin credentials.

19
 PASSIVE INFORMATION GATHERING
Analyzing packets
for key
information:

Going through each

of the requests to
extract the hashes
and checking them
in [Link]
The discovered credential
pairs are as follows:
• admin:admin123
• user:user123
• admin:123
• admin:ADMIN123
• root:root123
20
 PASSIVE INFORMATION GATHERING

Analyzing packets
for key
information:

Updated diagram based

on information gathered
through HTTP data
detection.

21
 PASSIVE INFORMATION GATHERING
Analyzing packets
for key information:
Idnetifying FTP traffic using Wireshark filter “ftp”.

Looking at the packet information, we can quickly find very

relevant and identifiable asset details, as shown here:
An AXIS Network Camera that is publishing an asset model number
and version for the camera inside the packet.

22
 PASSIVE INFORMATION GATHERING

Searching
Axis network
camera on
Exploitdb.

First entry:
Metasploit
module for
Remote code
Execution

23
 PASSIVE INFORMATION GATHERING

Updating diagram
and mapping RCE to
Axis 206 Network
Camera.

24
 DISCOVERING & LAUNCHING ATTACKS
Scanning
Rustscan scan with
reduced batch size “- b 10”
.
ICS-specific scripts such
as the following:
• bacnet-info
• enip-info
• modbus-discover
• s7-info

25
 DISCOVERING & LAUNCHING ATTACKS
Directory Enumeration
Gobuster
Three directories discovered:
• /main
• /web
• /Start
Enumerating directories behind the
/web path. We will use a different
wordlist found at
/usr/share/wordlist/dirbuster:
We have now found three new
directories: • /home
• /waiting 26
 DISCOVERING & LAUNCHING ATTACKS
Web Application Scanning
Feroxbuster
feroxbuster -u [Link]
-w ~/Downloads/scada. Txt

27
 DISCOVERING & LAUNCHING ATTACKS
Host Scanning
Enumerating host machines by their NetBIOS names.
Two hosts machines identified.
DC01
WS01
Taking an educated
guess that DC01
is the domain controller.

28
 DISCOVERING & LAUNCHING ATTACKS
Host Enumeration
Running enum4linux against the discovered machine name
DC01.
Discovered the LABCORP domain name.

We can enumerate users

that may exist on the
domain, using Kerbrute.

29
 DISCOVERING & LAUNCHING ATTACKS
User Enumeration
Using a list of traditional ICS users that contains usernames
such as: • admin, root,operator1,
operator2, operator3,
scada, scada-user,
scada1, scada2

Enumerated 4 valid
users.

30
 DISCOVERING & LAUNCHING ATTACKS
User Enumeration
Impacket-GetNPUsers command to see whether any of the AD
users have Kerberos preauthentication disabled.
impacket-GetNPUsers [Link]/Adminstrator -dc-ip
[Link] -no-pass

31
 METHODOLOGY
Active Testing

Activity Description

1. Performing penetration testing from public network

Pen testing Blackbox to OT internal gateway.

2. Perform penetration testing on OT network purdue

level 3.5.

3. Performing penetration testing from Corporate

network to OT network.

32
 METHODOLOGY
Active Testing
1. OT Infrastructure
a. Servers
b. Workstation
c. Network - Perimeter, DMZ and Internal Routers
The following is a comprehensive list d. Switches - Core, Distribution & L3
of assets that can be scoped in an OT e. VPN for vendor
VAPT exercise. 2. Active Directory Service Infrastructure on OT Infrastructure.
3. All the security devices, like NG-Firewall, IPS/IDS, EDR,
NAC etc.
4. Configuration review PLC, HMI, RTU's, etc. Purdue Level 2
5. Site-Wide SCADA Systems
6. Legacy SCADA systems
7. Building Management System (BMS]
8. Fire Alarm System (FAS)
9. Parking Management System.
10. HVAC and Light Management System
11. Access Control System (ACS)
12. Closed Circuit Tele Vision (CCTV)
13. 13. SOC and NOC integration 33
 METHODOLOGY
Active Testing
Activity Description

Scanning complete internal network for vulnerabilities

Internal Scanning within the distributed OT network to identify domain
Assessment - Whitebox controller, outbound gateway devices, internal routers,
and server network.

1. Subnet & Host discovery

2. Router enumeration
3. Dialup / Remote Access Server (RAS)
4. DNS enumeration
5. Firewall / IPS Testing
6. Virtualization Platform enumeration
7. FTP server enumeration
8. File server enumeration
9. Database server enumeration
10. Storage server enumeration
11. Management system enumeration

34
 METHODOLOGY
Active Testing
Activity Description

Scanning complete internal network for vulnerabilities

Internal Scanning within the distributed OT network to identify domain
Assessment - Whitebox controller, outbound gateway devices, internal routers,
and server network.
12. Antivirus / Antispam solution enumeration
Assessment of service functionality and
misconfiguration
13. Detecting password protected services.
14. Manual verification of know vulnerabilities on
services.
15. System Identification & Trusted System Scanning.
a. Match each open port to a service and protocol.
b. Identify server uptime to latest patch releases.
c. Identify the application behind the service and the patch level
using banners or fingerprinting.
d. Verify the application to the system and the version.
e. Locate and identify service remapping or system redirects.
f. Identify the components of the listening service.
g. Use UDP-based service and Trojan requests to all the systems in
the network. 35
 METHODOLOGY
Active Testing
Activity Description

ICS System Assessment

Process Network 1. Analysis of the network data traffic to identify
Assessment anomalous and potentially suspicious
communication sourced from or destined for.
2. Analysis of the asset owner's network traffic,
collected by the asset owners, from within their
control system environment.
3. Analyze the captured network traffic using a
combination of open source and commercially
available tools to develop a detailed representation
of the communications, flows, and relationships
between devices.
4. System log analysis provides an in-depth
evaluation of system log data. Asset owners submit
system or event logs which provide a sampling of
the central control system elements being assessed,
such as an ICS server, a Historian/Database
collector, or a remotely connected human-machine
interface system. 36
 METHODOLOGY
Active Testing
Activity Description

SCADA System Assessment

SCADA Assessment 1. Perform reconnaissance to gather information on
the target system if not previously defined in the
assessment plan
2. Scan the SCADA network for open ports and
vulnerabilities.
3. Achieve the Target of Evaluation (TOE) defined in
the assessment plan.
4. Prioritized vulnerabilities to assess based on the
probability of obtaining the target and its
significance.

37