This repository contains OPC UA scanner modules as well as their respective documentation. Furthermore, a list of OPC UA specific default credentials can be found in this repository. In order to use these modules, Metasploit needs to be installed on your system. For further information on the rationale behind these scanner modules, please refer to our research paper Assessing the Security of OPC UA Deployments presented at the 1st ITG Workshop on IT Security.
If you use any portion of our modules in your research work, please cite the following paper:
Linus Roepert, Markus Dahlmanns, Ina Berenice Fink, Jan Pennekamp and Martin Henze
Assessing the Security of OPC UA Deployments
Proceedings of the 1st ITG Workshop on IT Security (ITSec), Tübingen, Germany
April 2020.
BibTeX:
@inproceedings{roepert_opcua_2020,
author = {Roepert, Linus and Dahlmanns, Markus and Fink, Ina Berenice and Pennekamp, Jan and Henze, Martin},
title = {{Assessing the Security of OPC UA Deployments}},
booktitle = {Proceedings of the 1st ITG Workshop on IT Security (ITSec)},
year = {2020},
}
- Install Metasploit using the instructions found here. You may also use Kali Linux with a pre-installed version of Metasploit.
- If not already installed, install
python3
. - Install the opcua Module for python3, e.g., via pip:
pip3 install opcua
. - If you installed Metasploit yourself, merge the
modules
directory found in this repository with themodules
directory in the cloned Metasploit repository. If Metasploit is pre-installed, themodules
directory of this repository can be merged with~/.msf4/modules
. - To use the supplied modules follow the respective module documentation or see the typical workflow below.
A typical workflow could look as follows:
- Use nmap to discover potential OPC UA servers in a (local) network.
nmap -sS <IP_RANGE> -p <PORT>
- Use
opcua_hello
to verify that an OPC UA server runs on an open port
use auxiliary/scanner/opcua/opcua_hello
set rhosts <IP>
set rport <PORT>
run
- Use
opcua_server_config
to get a list of endpoints on an OPC UA server.
use auxiliary/scanner/opcua/opcua_server_config
set rhosts <IP>
set rport <PORT>
run
- Optional: Use
opcua_login
to brute-force credentials for OPC UA server instances.
use auxiliary/scanner/opcua/opcua_login
set rhosts <IP>
set rport <PORT>
set userpass <username> <password>
orset userpass file:<FILE>
- Optional: Set up the security mode and security policy of the endpoint you want to connect to (see
documentation/modules/auxiliary/scanner/opcua/opcua_login.md
) run
- Use
opcua_server_config
to obtain security related information for a specific OPC UA server.
use auxiliary/scanner/opcua/opcua_server_config
set rhosts <IP>
set rport <PORT>
- Set up the authentication method (see
documentation/modules/auxiliary/scanner/opcua/opcua_server_config.md
) - Set up the security mode and security policy of the endpoint you want to connect to (see
documentation/modules/auxiliary/scanner/opcua/opcua_server_config.md
) - Set up information you want to retrieve from the server (
servers
,nodes
,nodesverbose
; seedocumentation/modules/auxiliary/scanner/opcua/opcua_server_config.md
) run
Copyright 2020 RWTH Aachen University & Fraunhofer FKIE
This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program. If not, see http://www.gnu.org/licenses/.
If you are planning to integrate our modules into a commercial product and do not want to disclose your source code, please contact us for other licensing options via email at martin (dot) henze (at) fkie (dot) fraunhofer (dot) de
These modules have been developed within a cooperation between the Chair of Communication and Distributed Systems at RWTH Aachen University and the Fraunhofer Institute for Communication, Information Processing and Ergonomics FKIE. This work has partly been funded by the Deutsche Forschungsgemeinschaft (DFG, German Research Foundation) under Germany's Excellence Strategy – EXC-2023 Internet of Production – 390621612.