ICS/Modbus — Claus for Concern Advent of Cyber Tryhackme Writeup

Learn to identify and exploit weaknesses in ICS systems.

Hey hackers 👋

I’m a passionate cybersecurity enthusiast and ethical hacker. I love solving CTFs on TryHackMe and Hack The Box, while also diving into recently discovered vulnerabilities to enhance my skills.

This Is new for me to learn, I thought lets learn together & secure it.

This Is what I understood from this,

Summary of the TBFC Headquarters Crisis

The scene unfolds at TBFC headquarters in Wareville, where a winter storm coincides with chaos on what should be the busiest shipping day of the year. Instead of delivering Christmas gifts, warehouse workers are frustrated to find numerous Easter-themed packages — particularly chocolate eggs — being mistakenly shipped.

The Command Center Call

In the command center, everything appears operational — over 1,000 presents in stock and a 98% success rate. However, an avalanche of confused calls from customers reveals that they are receiving the wrong items, such as chocolate bunnies instead of teddy bears. The complex issue is soon linked to a message flashing on the monitors:

🐰 EGGSPLOIT v6.66 — Property of HopSec Island

“Why should Christmas have all the fun?” — King Malhare

This indicates a hack into the drone control systems, where sensor data is falsified, and inventories manipulated, presenting a serious threat to Christmas deliveries.

Mission Objective

Your goal is to investigate the compromised TBFC Drone Delivery System and uncover the workings of King Malhare’s Eggsploit team. You must act quickly to restore the holiday logistics, recognizing the presence of traps that could worsen the situation.

Discovery of a Critical Note

While examining the control room, you find a crumpled note detailing a register map for the drone systems. The note lists various elements vital for understanding the operational settings, such as:

• HR0: Package Type Selection
• 0 = Christmas Gifts
• 1 = Chocolate Eggs
• 2 = Easter Baskets
• HR1: Delivery Zone
• Coils: Boolean Flags for system status checks.

The note highlights the critical alert:

Critical Note: Changing HR0 while C11 is true will trigger a countdown.

This cryptic message raises more questions than answers, but it suggests the potential for system restoration if understood correctly.

Learning Objectives

1. Understand SCADA systems for monitoring industrial processes.
2. Explore the role of PLCs in automation.
3. Learn about the Modbus protocol for communication between devices.
4. Identify compromised system configurations.
5. Explore methods for remediating compromised control systems.
6. Understand protection mechanisms and trap logic in Industrial Control Systems (ICS).

Your journey to save Christmas has just begun, armed with newfound knowledge and the mysterious note that might just hold the key to the crisis!

What is SCADA?

SCADA stands for Supervisory Control and Data Acquisition, serving as the command center for industrial operations. It acts as a vital bridge between human operators and machinery, akin to the nervous system of a factory, sensing activities, processing data, and issuing commands. At TBFC, the SCADA system oversees the entire drone delivery operation, ensuring that hundreds of drones function smoothly to handle Christmas logistics.

Components of a SCADA System

A standard SCADA system comprises four essential components:

• Sensors & Actuators: These are the system’s eyes and hands. Sensors measure real-world parameters (like temperature or weight), while actuators perform physical tasks (like moving arms or opening valves). In TBFC’s warehouse, sensors detect packages on conveyor belts, while actuators control robotic arms for loading drones.
• PLCs (Programmable Logic Controllers): These act as the brain of the operation. PLCs read data from sensors, make decisions based on predetermined rules, and instruct actuators. For example, a PLC might command Drone 7 to load a chocolate egg if specific conditions are met.
• Monitoring Systems: Visual interfaces such as CCTV cameras and dashboards allow operators to observe processes in real-time. TBFC’s surveillance systems provide crucial live footage of the warehouse, facilitating immediate feedback.
• Historians: These are databases that capture operational data over time. By recording actions like package loading and system changes, historians help identify patterns, troubleshoot issues, and analyze incidents — like the ongoing attack.

SCADA in the Drone Delivery System

The compromised SCADA system at TBFC performs several critical tasks:

• Package Type Selection: It determines whether to load Christmas gifts, chocolate eggs, or Easter baskets onto each drone based on a numeric value.
• Delivery Zone Routing: Each package must go to the correct neighborhood, with regular zones (1–9) assigned to districts and Zone 10 designated for disposal.
• Visual Monitoring: The CCTV feeds enable operators to verify loading processes and check for anomalies.
• Inventory Verification: Before loading, the system can check stock availability. If verification is compromised, the system may blindly follow malicious commands.
• System Protection Mechanisms: Essential security features that monitor unauthorized changes but have been turned against TBFC as part of King Malhare’s trap.
• Audit Logging: Records every change and operator interaction. Attackers often disable logging to conceal their actions, which has occurred in this case.

Why SCADA Systems Are Targeted

SCADA systems increasingly attract cybercriminals for several reasons:

• Legacy Software Vulnerabilities: Many systems are outdated, lacking modern security patches.
• Unchanged Default Credentials: Administrators often neglect password changes, prioritizing system availability over security.
• Designed for Reliability, Not Security: Originally intended for closed networks, SCADA systems often lack authentication and encryption.
• Control of Physical Processes: Attacks can lead to real-world disruptions, such as blackouts or safety incidents.
• Connectivity to Corporate Networks: Many systems are not truly “air-gapped,” allowing attackers entry through connected business networks.
• Protocols Lacking Authentication: Protocols like Modbus allow unauthorized access to system values, posing significant security risks.

In early 2024, the first known ICS/OT malware, FrostyGoop, exploited the Modbus TCP protocol to manipulate industrial systems. King Malhare is using similar tactics not for widespread chaos, but to disrupt Christmas deliveries by tampering with the control system through Modbus.

In the next task, the focus will shift to the compromised component: the PLC.

What is a PLC?

A PLC (Programmable Logic Controller) is a robust industrial computer designed to control machinery and processes. Unlike standard computers, PLCs are built for reliability in severe conditions.

Key Features of PLCs

• Durability: Operates in extreme temperatures, vibrations, and environments with dust and moisture.
• Continuous Operation: Functions 24/7 for extended periods without needing reboots, ensuring no downtime.
• Real-time Control: Responds to sensor signals within milliseconds, crucial for safety and efficiency in machinery operation.
• Direct Hardware Interface: Connects to sensors and actuators, communicating in the electrical language of industrial devices.

What is Modbus?

Modbus is a communication protocol used by industrial devices to communicate with each other. Created in 1979, it’s one of the oldest and most widely adopted protocols due to its simplicity and reliability.

Modbus Communication Example

• Client: “PLC, what’s the value of register 0?”
• Server (PLC): “Register 0 holds the value 1.”

Security Concerns

Modbus lacks built-in security features like authentication or encryption, making any device accessible if it can reach the Modbus port — similar to leaving a door unlocked.

Modbus Data Types

Modbus organizes data into four types, each with specific purposes:

Type Purpose Values Example Use Cases Coils Digital outputs (on/off) 0 or 1 Motor status, valve status Discrete Inputs Digital inputs (on/off) 0 or 1 Button status, sensor triggered Holding Registers Analogue outputs (numbers) 0–65535 Temperature setpoints, motor speed Input Registers Analogue inputs (numbers) 0–65535 Current sensor readings

TBFC Application

In TBFC’s drone control system:

• Holding Registers: Store configurations like package type and delivery zones.
• Coils: Control key system behaviors, such as inventory verification and logging.

Modbus Addressing

Every data point in Modbus has a unique address:

• Modbus addresses start at 0. For example, Register 0 refers to the first register.

Examples from TBFC System

• HR0: Package type selector
• HR1: Delivery zone
• C10: Inventory verification flag

Modbus TCP vs Serial Modbus

Originally, Modbus used serial connections (RS-232 or RS-485) for device communication. Modern systems use Modbus TCP, which allows for remote monitoring and centralized management but exposes systems to network attacks.

Security Implications

King Malhare exploited this vulnerability by accessing the Modbus TCP port (502), issuing commands without needing physical access.

Security Problems with Modbus

Modbus has no inherent security mechanisms:

• No authentication: Anyone can connect and send commands.
• No encryption: Communications are in plaintext, easily intercepted.
• No authorization: Any client can read or write values freely.
• No integrity checking: Lacks verification against command tampering.

Connecting the Dots

King Malhare bypassed the standard web interface to manipulate PLC controls directly through Modbus TCP. The crumpled note you found details this manipulation and serves as a critical insight into the attack method.

Next, you will use Python and the pymodbus library to investigate the system and identify what changes have been made by King Malhare.

Time to do Practical:

Initial Reconnaissance: Let scan target to know open ports of system:

Nmap Result:

As we can see that the system is compromised,

Through the security camera, you can see the warehouse floor in real-time. Robotic arms are busy at work, and the conveyor belts are running smoothly. But something is wrong — instead of Christmas presents, you see:

• Pastel-coloured chocolate eggs being sorted
• Easter-themed packaging on the assembly line
• Delivery drones are loading eggs instead of gifts

The status display in the corner shows: Compromised

This visual confirmation tells you the problem is real and active. The system isn’t broken — it’s working perfectly, just delivering the wrong items. This is a classic sign of a logic manipulation attack rather than a system failure.

Keep this CCTV feed open in a separate tab. It will update as you make changes to the system, providing real-time feedback on your remediation efforts.

Modbus Reconnaissance:

lets install python library called **pip3 install pymodbus==3.6.8**

I made a script a to Establish Connection with Modbus & to gather info form Modbus.

we got our script executed

Safe Remediation

Based on our reconnaissance, we need to:

1. Disable protection mechanism (C11) FIRST
2. Change package type to Christmas gifts (HR0 = 0)
3. Enable inventory verification (C10 = True)
4. Enable audit logging (C13 = True)
5. Verify C15 never got armed

The order is critical. If we change HR0 before disabling C11, the trap triggers.

We completed this together now this scripts are provided on tryhackme in lab.

our system is restored…

now go & read Post-Incident Analysis & What If You Triggered the Trap? in lab

And come back till then bye..

Thankyou for reading…