Hacking SCADA Systems

With the discovery of stuxnet and all the subsequent interest in industrial control systems it's worthwhile to learn a bit on how to exploit these for our own purposes. For now it's a copypaste of various information on ICS products. Eventually I will rewrite it as a fluent tutorial, but until then you can use this article as a starting point in your own research.


Contents
 [hide]

    1 Terminology
    2 Default Passwords
    3 Google Dorks
    4 Vulnerabilities and Other Resources

Terminology

PLC: Programmable Logic Controller

RTU: Remote Terminal Unit

HMI: Human-Machine Interface


Default Passwords

These should always be your first try if you come across an HMI listed. Due to the fact that the amount of attention these systems have received has only been true recently many of these HMIs still have their defaults. These can be accessed using a web panel, telnet, or VNC. Links to support documents have been provided to familiarize yourself with these systems.

Schneider Electrics

pcfactory:pcfactory
loader:fwdownload
ntpupdate:ntpupdate
sysdiag:factorycast@schneider
test:testingpw
USER:USER
USER:USERUSER
webserver:webpages
fdrusers:sresurdf
nic2212:poiuypoiuy
nimrohs2212:qwertyqwerty
nip2212:fcsdfcsd
ftpuser:ftpuser
noe77111_v500:RcSyyebczS
AUTCSE:RybQRceeSd
AUT_CSE:cQdd9debez
target:RcQbRbzRyc

[1]


Siemens Simatic

Administrator:100

[2]


Siemens WinCC

WinCCConnect:2WSXcder
WinCCAdmin:2WSXcder

[3]


WAGO

admin:wago

[4]


Google Dorks

These will be added to as I go along, but are just a couple you can try out to search for HMIs.

inurl:/plc/webvisu.htm
"Miniweb on" "Control Functions" -filetype:pdf


Vulnerabilities and Other Resources

    Vulnerabilities in some SCADA server softwares
    Metasploit Modules for SCADA-related Vulnerabilities
    SIMATIC HMI panels - some default Simatic HMIs you can play around with