Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix - Ethernet/IP Device info (enip) #579

Open
TheMalwareGuardian opened this issue Jan 26, 2023 · 0 comments
Open

Fix - Ethernet/IP Device info (enip) #579

TheMalwareGuardian opened this issue Jan 26, 2023 · 0 comments
Labels

Comments

@TheMalwareGuardian
Copy link

Describe the bug
I have deployed Conpot using the default template to analyze EtherNet/IP, but when I try to scan the machine (in which i deploy the honeypot) using some nmap script like enip-info (nmap --script enip-info -sU -p 44818 ) it always returns the same values. It doesn't matter what values you write at templates/default/enip/enip.xml because those values are no picked to create an object (that part was not implemented).

To Reproduce
Steps to reproduce the behavior:

  1. Install Conpot (documentation)
  2. Run Conpot using the default template (conpot --template default --force)
  3. Execute nmap script against the machine (nmap --script enip-info -sU -p 44818 194.1x.x.x)
  4. See output
  5. Stop Conpot (ctrl+c)
  6. Change some value in the file enip.xml (for example: < ProductName>ThisShouldChange< /ProductName>)
  7. Run Conpot again
  8. Execute nmap script again
  9. Compare outputs (Both outputs have the same information)

Solution
I have modified the code of Conpot to update this functionality and now it works as expected. I create an object using the values the user provide in enip.xml and I pass that object as an argument to the correct function, so the response is created with the values the user wants. Here is the commit: aec74ee

Expected behavior
When you update the code, you can change some values in enip.xml and you will see a new output if you scan the honeypot again:
PORT STATE SERVICE
44818/tcp open EtherNet-IP-2
| enip-info:
| type: DC Power Generator (31)
| vendor: Eaton Electrical (68)
| productName: CustomThisName
| serialNumber: 0x000abfc2
| productCode: 70
| revision: 16.1
| status: 0x3160
| state: 0xff
|_ deviceIp: 0.0.0.0

Desktop (please complete the following information):

  • OS: Debian 5.10.103-1 (2022-03-07) x86_64 GNU/Linux
  • Python 3.9.2

Additional context
Workflow:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant