Distributed Network Protocol (DNP3) Detection
🗓️ 13 Dec 2017 00:00:00Reported by Copyright (C) 2017 Greenbone AGType 
openvas🔗 plugins.openvas.org👁 54 Views
| Source | Link |
|---|---|
| dnp | www.dnp.org/ |
# SPDX-FileCopyrightText: 2017 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only
if(description)
{
script_oid("1.3.6.1.4.1.25623.1.0.140597");
script_version("2023-07-25T05:05:58+0000");
script_tag(name:"last_modification", value:"2023-07-25 05:05:58 +0000 (Tue, 25 Jul 2023)");
script_tag(name:"creation_date", value:"2017-12-13 16:47:57 +0700 (Wed, 13 Dec 2017)");
script_tag(name:"cvss_base", value:"0.0");
script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:N/I:N/A:N");
script_tag(name:"qod_type", value:"remote_banner");
script_name("Distributed Network Protocol (DNP3) Detection");
script_tag(name:"summary", value:"A Distributed Network Protocol (DNP3) Service is running at this host.
DNP3 (Distributed Network Protocol) is a set of communications protocols used between components in process
automation systems. DNP3 has become widely utilized in adjacent industries such as water/waste water,
transportation and the oil and gas industry.
The protocol is used by several devices of different SCADA vendors.");
script_category(ACT_GATHER_INFO);
script_copyright("Copyright (C) 2017 Greenbone AG");
script_family("Service detection");
script_dependencies("find_service.nasl");
script_require_ports("Services/unknown", 20000);
script_xref(name:"URL", value:"https://www.dnp.org");
exit(0);
}
include("host_details.inc");
include("byte_func.inc");
include("port_service_func.inc");
# based on https://github.com/digitalbond/Redpoint/blob/master/dnp3-info.nse
# and https://github.com/amolsarwate/scadascan/blob/master/scadascan.pl (although this one is kind of broken)
# Seems we have to ask for a specivic destination address, so we send around 100 addresses in one request and hope
# one of them will answer
# Example request:
# 0x05, 0x64, protocol identifier
# 0x05, length
# 0xc9, control byte
# 0xf1, 0xff, destination address
# 0x05, 0x00, source address
# 0xaa, 0xd2 CRC
query = raw_string(0x05, 0x64, 0x05, 0xc9, 0x00, 0x00, 0x00, 0x00, 0x36, 0x4c,
0x05, 0x64, 0x05, 0xc9, 0x01, 0x00, 0x00, 0x00, 0xde, 0x8e,
0x05, 0x64, 0x05, 0xc9, 0x02, 0x00, 0x00, 0x00, 0x9f, 0x84,
0x05, 0x64, 0x05, 0xc9, 0x03, 0x00, 0x00, 0x00, 0x77, 0x46,
0x05, 0x64, 0x05, 0xc9, 0x04, 0x00, 0x00, 0x00, 0x1d, 0x90,
0x05, 0x64, 0x05, 0xc9, 0x05, 0x00, 0x00, 0x00, 0xf5, 0x52,
0x05, 0x64, 0x05, 0xc9, 0x06, 0x00, 0x00, 0x00, 0xb4, 0x58,
0x05, 0x64, 0x05, 0xc9, 0x07, 0x00, 0x00, 0x00, 0x5c, 0x9a,
0x05, 0x64, 0x05, 0xc9, 0x08, 0x00, 0x00, 0x00, 0x19, 0xb9,
0x05, 0x64, 0x05, 0xc9, 0x09, 0x00, 0x00, 0x00, 0xf1, 0x7b,
0x05, 0x64, 0x05, 0xc9, 0x0a, 0x00, 0x00, 0x00, 0xb0, 0x71,
0x05, 0x64, 0x05, 0xc9, 0x0b, 0x00, 0x00, 0x00, 0x58, 0xb3,
0x05, 0x64, 0x05, 0xc9, 0x0c, 0x00, 0x00, 0x00, 0x32, 0x65,
0x05, 0x64, 0x05, 0xc9, 0x0d, 0x00, 0x00, 0x00, 0xda, 0xa7,
0x05, 0x64, 0x05, 0xc9, 0x0e, 0x00, 0x00, 0x00, 0x9b, 0xad,
0x05, 0x64, 0x05, 0xc9, 0x0f, 0x00, 0x00, 0x00, 0x73, 0x6f,
0x05, 0x64, 0x05, 0xc9, 0x10, 0x00, 0x00, 0x00, 0x11, 0xeb,
0x05, 0x64, 0x05, 0xc9, 0x11, 0x00, 0x00, 0x00, 0xf9, 0x29,
0x05, 0x64, 0x05, 0xc9, 0x12, 0x00, 0x00, 0x00, 0xb8, 0x23,
0x05, 0x64, 0x05, 0xc9, 0x13, 0x00, 0x00, 0x00, 0x50, 0xe1,
0x05, 0x64, 0x05, 0xc9, 0x14, 0x00, 0x00, 0x00, 0x3a, 0x37,
0x05, 0x64, 0x05, 0xc9, 0x15, 0x00, 0x00, 0x00, 0xd2, 0xf5,
0x05, 0x64, 0x05, 0xc9, 0x16, 0x00, 0x00, 0x00, 0x93, 0xff,
0x05, 0x64, 0x05, 0xc9, 0x17, 0x00, 0x00, 0x00, 0x7b, 0x3d,
0x05, 0x64, 0x05, 0xc9, 0x18, 0x00, 0x00, 0x00, 0x3e, 0x1e,
0x05, 0x64, 0x05, 0xc9, 0x19, 0x00, 0x00, 0x00, 0xd6, 0xdc,
0x05, 0x64, 0x05, 0xc9, 0x1a, 0x00, 0x00, 0x00, 0x97, 0xd6,
0x05, 0x64, 0x05, 0xc9, 0x1b, 0x00, 0x00, 0x00, 0x7f, 0x14,
0x05, 0x64, 0x05, 0xc9, 0x1c, 0x00, 0x00, 0x00, 0x15, 0xc2,
0x05, 0x64, 0x05, 0xc9, 0x1d, 0x00, 0x00, 0x00, 0xfd, 0x00,
0x05, 0x64, 0x05, 0xc9, 0x1e, 0x00, 0x00, 0x00, 0xbc, 0x0a,
0x05, 0x64, 0x05, 0xc9, 0x1f, 0x00, 0x00, 0x00, 0x54, 0xc8,
0x05, 0x64, 0x05, 0xc9, 0x20, 0x00, 0x00, 0x00, 0x01, 0x4f,
0x05, 0x64, 0x05, 0xc9, 0x21, 0x00, 0x00, 0x00, 0xe9, 0x8d,
0x05, 0x64, 0x05, 0xc9, 0x22, 0x00, 0x00, 0x00, 0xa8, 0x87,
0x05, 0x64, 0x05, 0xc9, 0x23, 0x00, 0x00, 0x00, 0x40, 0x45,
0x05, 0x64, 0x05, 0xc9, 0x24, 0x00, 0x00, 0x00, 0x2a, 0x93,
0x05, 0x64, 0x05, 0xc9, 0x25, 0x00, 0x00, 0x00, 0xc2, 0x51,
0x05, 0x64, 0x05, 0xc9, 0x26, 0x00, 0x00, 0x00, 0x83, 0x5b,
0x05, 0x64, 0x05, 0xc9, 0x27, 0x00, 0x00, 0x00, 0x6b, 0x99,
0x05, 0x64, 0x05, 0xc9, 0x28, 0x00, 0x00, 0x00, 0x2e, 0xba,
0x05, 0x64, 0x05, 0xc9, 0x29, 0x00, 0x00, 0x00, 0xc6, 0x78,
0x05, 0x64, 0x05, 0xc9, 0x2a, 0x00, 0x00, 0x00, 0x87, 0x72,
0x05, 0x64, 0x05, 0xc9, 0x2b, 0x00, 0x00, 0x00, 0x6f, 0xb0,
0x05, 0x64, 0x05, 0xc9, 0x2c, 0x00, 0x00, 0x00, 0x05, 0x66,
0x05, 0x64, 0x05, 0xc9, 0x2d, 0x00, 0x00, 0x00, 0xed, 0xa4,
0x05, 0x64, 0x05, 0xc9, 0x2e, 0x00, 0x00, 0x00, 0xac, 0xae,
0x05, 0x64, 0x05, 0xc9, 0x2f, 0x00, 0x00, 0x00, 0x44, 0x6c,
0x05, 0x64, 0x05, 0xc9, 0x30, 0x00, 0x00, 0x00, 0x26, 0xe8,
0x05, 0x64, 0x05, 0xc9, 0x31, 0x00, 0x00, 0x00, 0xce, 0x2a,
0x05, 0x64, 0x05, 0xc9, 0x32, 0x00, 0x00, 0x00, 0x8f, 0x20,
0x05, 0x64, 0x05, 0xc9, 0x33, 0x00, 0x00, 0x00, 0x67, 0xe2,
0x05, 0x64, 0x05, 0xc9, 0x34, 0x00, 0x00, 0x00, 0x0d, 0x34,
0x05, 0x64, 0x05, 0xc9, 0x35, 0x00, 0x00, 0x00, 0xe5, 0xf6,
0x05, 0x64, 0x05, 0xc9, 0x36, 0x00, 0x00, 0x00, 0xa4, 0xfc,
0x05, 0x64, 0x05, 0xc9, 0x37, 0x00, 0x00, 0x00, 0x4c, 0x3e,
0x05, 0x64, 0x05, 0xc9, 0x38, 0x00, 0x00, 0x00, 0x09, 0x1d,
0x05, 0x64, 0x05, 0xc9, 0x39, 0x00, 0x00, 0x00, 0xe1, 0xdf,
0x05, 0x64, 0x05, 0xc9, 0x3a, 0x00, 0x00, 0x00, 0xa0, 0xd5,
0x05, 0x64, 0x05, 0xc9, 0x3b, 0x00, 0x00, 0x00, 0x48, 0x17,
0x05, 0x64, 0x05, 0xc9, 0x3c, 0x00, 0x00, 0x00, 0x22, 0xc1,
0x05, 0x64, 0x05, 0xc9, 0x3d, 0x00, 0x00, 0x00, 0xca, 0x03,
0x05, 0x64, 0x05, 0xc9, 0x3e, 0x00, 0x00, 0x00, 0x8b, 0x09,
0x05, 0x64, 0x05, 0xc9, 0x3f, 0x00, 0x00, 0x00, 0x63, 0xcb,
0x05, 0x64, 0x05, 0xc9, 0x40, 0x00, 0x00, 0x00, 0x58, 0x4a,
0x05, 0x64, 0x05, 0xc9, 0x41, 0x00, 0x00, 0x00, 0xb0, 0x88,
0x05, 0x64, 0x05, 0xc9, 0x42, 0x00, 0x00, 0x00, 0xf1, 0x82,
0x05, 0x64, 0x05, 0xc9, 0x43, 0x00, 0x00, 0x00, 0x19, 0x40,
0x05, 0x64, 0x05, 0xc9, 0x44, 0x00, 0x00, 0x00, 0x73, 0x96,
0x05, 0x64, 0x05, 0xc9, 0x45, 0x00, 0x00, 0x00, 0x9b, 0x54,
0x05, 0x64, 0x05, 0xc9, 0x46, 0x00, 0x00, 0x00, 0xda, 0x5e,
0x05, 0x64, 0x05, 0xc9, 0x47, 0x00, 0x00, 0x00, 0x32, 0x9c,
0x05, 0x64, 0x05, 0xc9, 0x48, 0x00, 0x00, 0x00, 0x77, 0xbf,
0x05, 0x64, 0x05, 0xc9, 0x49, 0x00, 0x00, 0x00, 0x9f, 0x7d,
0x05, 0x64, 0x05, 0xc9, 0x4a, 0x00, 0x00, 0x00, 0xde, 0x77,
0x05, 0x64, 0x05, 0xc9, 0x4b, 0x00, 0x00, 0x00, 0x36, 0xb5,
0x05, 0x64, 0x05, 0xc9, 0x4c, 0x00, 0x00, 0x00, 0x5c, 0x63,
0x05, 0x64, 0x05, 0xc9, 0x4d, 0x00, 0x00, 0x00, 0xb4, 0xa1,
0x05, 0x64, 0x05, 0xc9, 0x4e, 0x00, 0x00, 0x00, 0xf5, 0xab,
0x05, 0x64, 0x05, 0xc9, 0x4f, 0x00, 0x00, 0x00, 0x1d, 0x69,
0x05, 0x64, 0x05, 0xc9, 0x50, 0x00, 0x00, 0x00, 0x7f, 0xed,
0x05, 0x64, 0x05, 0xc9, 0x51, 0x00, 0x00, 0x00, 0x97, 0x2f,
0x05, 0x64, 0x05, 0xc9, 0x52, 0x00, 0x00, 0x00, 0xd6, 0x25,
0x05, 0x64, 0x05, 0xc9, 0x53, 0x00, 0x00, 0x00, 0x3e, 0xe7,
0x05, 0x64, 0x05, 0xc9, 0x54, 0x00, 0x00, 0x00, 0x54, 0x31,
0x05, 0x64, 0x05, 0xc9, 0x55, 0x00, 0x00, 0x00, 0xbc, 0xf3,
0x05, 0x64, 0x05, 0xc9, 0x56, 0x00, 0x00, 0x00, 0xfd, 0xf9,
0x05, 0x64, 0x05, 0xc9, 0x57, 0x00, 0x00, 0x00, 0x15, 0x3b,
0x05, 0x64, 0x05, 0xc9, 0x58, 0x00, 0x00, 0x00, 0x50, 0x18,
0x05, 0x64, 0x05, 0xc9, 0x59, 0x00, 0x00, 0x00, 0xb8, 0xda,
0x05, 0x64, 0x05, 0xc9, 0x5a, 0x00, 0x00, 0x00, 0xf9, 0xd0,
0x05, 0x64, 0x05, 0xc9, 0x5b, 0x00, 0x00, 0x00, 0x11, 0x12,
0x05, 0x64, 0x05, 0xc9, 0x5c, 0x00, 0x00, 0x00, 0x7b, 0xc4,
0x05, 0x64, 0x05, 0xc9, 0x5d, 0x00, 0x00, 0x00, 0x93, 0x06,
0x05, 0x64, 0x05, 0xc9, 0x5e, 0x00, 0x00, 0x00, 0xd2, 0x0c,
0x05, 0x64, 0x05, 0xc9, 0x5f, 0x00, 0x00, 0x00, 0x3a, 0xce,
0x05, 0x64, 0x05, 0xc9, 0x60, 0x00, 0x00, 0x00, 0x6f, 0x49,
0x05, 0x64, 0x05, 0xc9, 0x61, 0x00, 0x00, 0x00, 0x87, 0x8b,
0x05, 0x64, 0x05, 0xc9, 0x62, 0x00, 0x00, 0x00, 0xc6, 0x81,
0x05, 0x64, 0x05, 0xc9, 0x63, 0x00, 0x00, 0x00, 0x2e, 0x43,
0x05, 0x64, 0x05, 0xc9, 0x64, 0x00, 0x00, 0x00, 0x44, 0x95);
# Function codes
# Secondary to Primary
func_id = make_array( 0, "ACK",
1, "NACK",
11, "Status of Link",
14, "Link Service Not Functioning",
15, "Link Service Not Used or Implemented" );
# Primary to Secondary
alt_func_id = make_array( 0, "Reset of Remote Link",
1, "Reset of User Process",
2, "Test Function For Link",
3, "User Data",
4, "Unconfirmed User Data",
9, "Request Link Status" );
#
# Function Code/ID Mapping
#
function get_ctrl_type(id) {
if (id <= 15) {
foreach type (keys(func_id)) {
if (id == type)
return func_id[type];
}
return "Unknown function ID";
}
else {
id = id % 16;
foreach type (keys(alt_func_id)) {
if (id == type)
return alt_func_id[type];
}
return "Unknown function ID";
}
}
port = unknownservice_get_port(default: 20000);
soc = open_sock_tcp(port);
if (!soc)
exit(0);
send(socket: soc, data: query);
recv = recv(socket: soc, length: 512);
close(soc);
if (!recv || hexstr(substr(recv, 0, 1)) != '0564' || strlen(recv) < 10)
exit(0);
set_kb_item(name: "dnp3/detected", value: TRUE);
service_register(port: port, proto: "dnp3");
set_byte_order(BYTE_ORDER_LITTLE_ENDIAN);
dst_addr = getword(blob: recv, pos: 4);
src_addr = getword(blob: recv, pos: 6);
# write the raw words to the KB
set_kb_item(name: "dnp3/dst_addr", value: substr(recv, 4, 5));
set_kb_item(name: "dnp3/src_addr", value: substr(recv, 6, 7));
ctrl_code = ord(recv[3]);
ctrl = get_ctrl_type(id: ctrl_code);
report = 'A DNP3 service is running at this port.\n\nThe following information was returned:\n\n' +
'Control Function Code: ' + ctrl + ' (' + ctrl_code + ')\n' +
'Source Address: ' + src_addr + '\n' +
'Destination Address: ' + dst_addr + '\n';
log_message(port: port, data: report);
exit(0);
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
25 Jul 2023 00:00Current
7High risk
Vulners AI Score7