Very Basic Modbus Fuzzing

__author__ = 'mtoecker'

import binascii
import socket
import datetime
import time
import random
from string import maketrans


## Code by @mtoecker

print 'Starting Modbus Impersonation routine\n'
random.seed(time.time())


# Modbus Requests from the Test System
# Get these by using Wireshark to listen for modbus requests
req1 = ''
req2 = ''
req3 = ''
req4 = ''
req5 = ''

print ' Requests Stored\n'

# Modbus Responses from the RTU
# Use Wireshark to get these as well, they will be the responses FROM the RTU
resp1 = ''
resp2 = ''
resp3 = ''
resp4 = ''
resp5 = ''
print ' Responses Stored\n'

try:
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    s.bind(('0.0.0.0', 2100))
    print 'Created socket\n'
    s.listen(5)
    print 'Socket now listening\n'
except Exception:
    print "Socket Error.  Will not continue"
    raise

conn, addr = s.accept()

print 'Connected with ' + addr[0] + ':' + str(addr[1])

inc = 1

while True:

    respnum = 0
    response = ''
    request = conn.recv(1024)
    print 'Received:\n' + binascii.hexlify(request) + '\n'

    if request == req1:
        response = resp1
        respnum = 1
    if request == req2:
        response = resp2
        respnum = 2
    if request == req3:
        response = resp3
        respnum = 3
    if request == req4:
        response = resp4
        respnum = 4
    if request == req5:
        response = resp5
        respnum = 5

    if respnum <> 0:
        try:
            filename = './NoCRC/' + str(respnum) + '/NoCRCTest-' + str(inc) + '.txt'

            f = open(filename, 'w+')
        except Exception:
            print "File DNE, not writable, or other file error.  Exiting."
            raise

        (f.write('TimeStamp: ' + datetime.datetime.fromtimestamp(time.time()).strftime('%Y-%m-%d %H:%M:%S') + '\n'))

        f.write('Received:' + binascii.hexlify(request) + '\n')
        if respnum == 1:
            conn.send(response)
        else:

            #Start ByteFlippin
            flipbyte = random.randint(0, len(response) - 1)
            flippos = random.randint(0, 8)

            list_array = list(response)
            list_array[flipbyte] = chr(random.randint(0, 255))
            response = ''.join(list_array)

            f.write('Altered Byte: ' + str(flipbyte) + '\n')

            f.write('Responded:\n' + binascii.hexlify(response) + '\n')

            conn.send(response)
            print 'Responded:\n' + binascii.hexlify(response) + '\n'

    else:

        break

    f.close()

    inc += 1

conn.close()