使用Wireshark分析工控协议

布满荆棘的人生 2022-09-16 13:22 253阅读 0赞

在工控系统中通信协议存在众多标准，也存在众多私有协议，如果你有过使用组态软件的经历，你便会发现，在第一步连接设备时除连接设备的方式有以太网/串行等方式外，各家基本上都存在自己的私有通信协议。  
![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3doYXRkYXk_size_16_color_FFFFFF_t_70][]

上图为，某SCADA软件驱动配置界面

大家都知道普遍的工控协议在传输的过程不加密、协议上无认证，往往可以通过协议分析，并形成一些测试用例针对特定运行环境下支持该协议的设备达到异常运行的效果。如之前提到过的强制操作物理输出（[使用FINS协议攻击欧姆龙（Omron）PLC的物理（I/O）输出][FINS_Omron_PLC_I_O]）、程序的上传下载、重置设备状态等。而这个过程中除官方提供的一些协议文档外，像wireshark也支持了大量的工控协议，可以很方便的了解协议中的一些字段的功能、命令等。

# 私有协议分类 #

在众多公开或私有协议中可分为如下几类：  
标准协议：国际标准或公认的标准协议，如Modbus、DNP3、IEC104等  
私有公开：只有厂商自己设备支持并提供官方协议文档，如Omron FINS协议、三菱Melsec协议等  
私有不公开：只有厂商自己设备支持且官方不提供协议文档，如S7、西门子PPI协议、GE SRTP等

# 使用Wireshark分析常见工控协议 #

Wireshark是一个强大开源流量与协议分析工具，除了传统网络协议解码外，还支持众多主流和标准工控协议的分析与解码。为此我整理了Wireshark源码中涉及与自控有关的协议的packet dissection实现代码路径，供大家参考和自己留存。

<table> 
 <tbody> 
  <tr> 
   <td>序号</td> 
   <td>协议类型</td> 
   <td>源码下载</td> 
   <td>简介</td> 
  </tr> 
  <tr> 
   <td>1</td> 
   <td>Siemens S7</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-s7comm.c</td> 
   <td>西门子PLC支持的通讯协议</td> 
  </tr> 
  <tr> 
   <td>2</td> 
   <td>MMS(IEC61850)</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/asn1/mms</td> 
   <td>输配电通讯协议</td> 
  </tr> 
  <tr> 
   <td>3</td> 
   <td>GOOSE(IEC61850)</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/asn1/goose</td> 
   <td>输配电通讯协议</td> 
  </tr> 
  <tr> 
   <td>4</td> 
   <td>SV(IEC61850)</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/asn1/sv</td> 
   <td>输配电通讯协议</td> 
  </tr> 
  <tr> 
   <td>5</td> 
   <td>Modbus</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-mbtcp.c</td> 
   <td>工控标准协议</td> 
  </tr> 
  <tr> 
   <td>6</td> 
   <td>OPC DA</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-dcom.c</td> 
   <td>工控标准协议</td> 
  </tr> 
  <tr> 
   <td>7</td> 
   <td>FF HSE</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-ff.c</td> 
   <td>基金会现场总线以太网通信协定</td> 
  </tr> 
  <tr> 
   <td>8</td> 
   <td>IEC 104</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-iec104.c</td> 
   <td>输配电通讯协议</td> 
  </tr> 
  <tr> 
   <td>9</td> 
   <td>Ethernet POWERLINK</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-epl.c</td> 
   <td>开放式实时以太网通信</td> 
  </tr> 
  <tr> 
   <td>10</td> 
   <td>OPC UA</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/plugins/opcua/opcua.c</td> 
   <td>OPC新一代标准</td> 
  </tr> 
  <tr> 
   <td>11</td> 
   <td>HART-IP</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-hartip.c</td> 
   <td>高速可寻址远程传感器协议</td> 
  </tr> 
  <tr> 
   <td>12</td> 
   <td>CoAP</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-coap.c</td> 
   <td>轻量应用层协议</td> 
  </tr> 
  <tr> 
   <td>13</td> 
   <td>Omron FINS</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-omron-fins.c</td> 
   <td>欧姆龙PLC支持的通讯协定</td> 
  </tr> 
  <tr> 
   <td>14</td> 
   <td>openSAFETY</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-opensafety.c</td> 
   <td>开源安全应用协议</td> 
  </tr> 
  <tr> 
   <td>15</td> 
   <td>EGD(Ethernet Global Data)</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-egd.c</td> 
   <td>GE Fanuc为PLC开发的通讯协定</td> 
  </tr> 
  <tr> 
   <td>16</td> 
   <td>DNP3</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-dnp.c</td> 
   <td>分布式网络协议，主要用于电力行业</td> 
  </tr> 
  <tr> 
   <td>17</td> 
   <td>Sinec H1</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-h1.c</td> 
   <td>西门子PLC支持的通讯协议</td> 
  </tr> 
  <tr> 
   <td>18</td> 
   <td>Profinet</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/plugins/profinet/</td> 
   <td>开放式的工业以太网通讯协定</td> 
  </tr> 
  <tr> 
   <td>19</td> 
   <td>EtherCAT</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/plugins/ethercat/</td> 
   <td>德国Beckhoff公司推动的开放式实时以太网通讯协定</td> 
  </tr> 
  <tr> 
   <td>20</td> 
   <td>SERCOS III</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-sercosiii.c</td> 
   <td>实时以太网通讯协定</td> 
  </tr> 
  <tr> 
   <td>21</td> 
   <td>RTPS</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-rtps.c</td> 
   <td>实时流传输协议</td> 
  </tr> 
  <tr> 
   <td>22</td> 
   <td>TTEthernet</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-tte.c</td> 
   <td>实时以太网通讯协定</td> 
  </tr> 
  <tr> 
   <td>23</td> 
   <td>CDT</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-cdt.c</td> 
   <td>远动规约</td> 
  </tr> 
  <tr> 
   <td>24</td> 
   <td>EtherNet/IP</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-etherip.c</td> 
   <td>工业通讯协定（Industrial Protocol），是一种CIP的实现方式，由罗克韦尔自动化公司所设计</td> 
  </tr> 
  <tr> 
   <td>25</td> 
   <td>CIP</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-cip.c</td> 
   <td>通用工业协定</td> 
  </tr> 
  <tr> 
   <td>26</td> 
   <td>CIP Safety</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-cipsafety.c</td> 
   <td>安全通用工业协定</td> 
  </tr> 
  <tr> 
   <td>27</td> 
   <td>DeviceNet</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-devicenet.c</td> 
   <td>一种CIP的实现方式，由Allen-Bradley公司所设计</td> 
  </tr> 
  <tr> 
   <td>28</td> 
   <td>BACnet</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-bacnet.c</td> 
   <td>楼宇自动控制网络数据通讯协议</td> 
  </tr> 
  <tr> 
   <td>29</td> 
   <td>KNXnet/IP</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-knxnetip.c</td> 
   <td>住宅和楼宇控制标准</td> 
  </tr> 
  <tr> 
   <td>30</td> 
   <td>Lontalk</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-lon.c</td> 
   <td>埃施朗公司的LonWorks技术所使用的通讯协议</td> 
  </tr> 
  <tr> 
   <td>31</td> 
   <td>CANopen</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-canopen.c</td> 
   <td>控制局域网通讯协定</td> 
  </tr> 
  <tr> 
   <td>32</td> 
   <td>SAE J1939</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-j1939.c</td> 
   <td>一种CAN的变种，适用在农业车辆及商用车辆</td> 
  </tr> 
  <tr> 
   <td>33</td> 
   <td>USITT DMX512-A</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-dmx.c</td> 
   <td>灯光控制数据传输协议</td> 
  </tr> 
  <tr> 
   <td>34</td> 
   <td>BSSAP/BSAP</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-bssap.c</td> 
   <td>由Bristol Babcock Inc发展的通讯协定</td> 
  </tr> 
  <tr> 
   <td>35</td> 
   <td>Gryphon</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/plugins/gryphon</td> 
   <td>车用通讯协定</td> 
  </tr> 
  <tr> 
   <td>36</td> 
   <td>ZigBee</td> 
   <td>https://github.com/wireshark/wireshark/tree/master/epan/dissectors/packet-zbee.h</td> 
   <td>开放式的无线通讯协定</td> 
  </tr> 
 </tbody> 
</table>

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3doYXRkYXk_size_16_color_FFFFFF_t_70]: /images/20220828/340700bdbe8d4292bf58b893c05fb79b.png
[FINS_Omron_PLC_I_O]: http://plcscan.org/blog/2015/11/attacks-omron-plc-coils-output/