Modbus — The Deepest Industrial Protocol and Its Real Attacks

Modbus was introduced by Modicon in 1979 and is still one of the most widely used communication protocols in industrial control systems (ICS) in 2026. Its simplicity and reliability have made it the standard in most PLCs, RTUs, and industrial devices, despite its age.

---

Modbus Types

Modbus is implemented in four main modes:

1. Modbus RTU
- Compressed binary format
- Suitable for serial communication (RS-232 / RS-485)
- High speed and widely used in industrial environments
- Has CRC16 for integrity check

2. Modbus ASCII
- Text format (seven bits)
- Human-readable
- Slower than RTU and more used for debugging

3. Modbus TCP (the most common currently)
- TCP/IP-based version
- Uses port 502
- No CRC (because TCP has its own checksum)
- Suitable for Ethernet and IIoT networks

4. Modbus UDP
- Connectionless version
- Higher speed but no delivery guarantee
- Less commonly used

---

Detailed Structure of Modbus TCP Packet

Modbus TCP consists of two main parts:

1. MBAP Header (7 bytes)

- Transaction Identifier (2 bytes): To match request and response
- Protocol Identifier (2 bytes): Always 0x0000
- Length (2 bytes): Length of the next segment (Unit ID + PDU)
- Unit Identifier (1 byte): Slave address (usually 1)

2. PDU (Protocol Data Unit)

- Function Code (1 byte)

- Data (variable length)

A complete example of a Read Holding Registers (Function 03) packet:

Transaction ID : 00 01
Protocol ID    : 00 00
Length        : 00 06
Unit ID        : 01
Function Code   : 03
Starting Address: 00 00
Quantity       : 00 0A

---

Sensitive and Dangerous Function Codes

In order (function code, title, level, target)

01 / 02   | Read Coils / Discrete Inputs      | Medium    | Reconnaissance

03 / 04   | Read Holding / Input Registers   | High     | Data LeakageCommand Injection / Actuator Control

15 / 16    | Write Multiple Coils / Registers | Very High | Mass Control / Process Manipulation

08     | Diagnostics | High      | DoS, Device Reset

43 (0x2B)    | Encapsulated Interface Transport | Very High | Backdoor, Vendor-Specific RCE

---

Real and Famous Attacks on Modbus Protocol

- Stuxnet (2010): The first physical cyberattack in history. Used Modbus to change the frequency of uranium enrichment centrifuges.
- Industroyer / CrashOverride (2016): Attack on the Ukrainian power grid. Modbus TCP was used to control breakers and cause blackouts.
- Oldsmar Water Attack (2021): An attacker infiltrated the SCADA system of the city of Oldsmar, Florida via the Internet and used Modbus to greatly increase the amount of sodium hydroxide (caustic soda).
- Multiple attacks by APT groups (such as Sandworm and APT33) in 2023–2026, mainly using Write Function Codes (05, 06, 15, 16) to manipulate physical processes.

---

Actual Attack Techniques and Payloads

1. Reconnaissance (Function 03)

# Read first 100 registers
packet = b'\x00\x01\x00\x00\x00\x06\x01\x03\x00\x00\x00\x64'

2. Write Single Register (Function 06) — Direct Control

# Change the value of a register to the maximum (e.g. motor speed)
payload = struct.pack(">HH", 0x0000, 0xFFFF)   # Address 0, Value 65535

3. Mass Write (Function 16) — Control

# Write 20 registers with dangerous values
values ​​= [0xFFFF] * 20
payload = struct.pack(">HH", 0x0000, 20) + struct.pack(">" + "H"*20, *values)

4. DoS and Crash Payload
- Sending PDU with very large or zero Length Field
- Invalid Function Codes (0x80 to 0xFF)
- Very long Payloads (more than 250 bytes) can also be mentioned
- Rapid repetition of requests with the same Transaction ID

5. Replay Attack
Capturing packets and replaying them at the right time to cause physical disruption.

نسخه فارسی✅
-----

Modbus — عمیق‌ترین پروتکل صنعتی و حملات واقعی آن

Modbus در سال ۱۹۷۹ توسط شرکت Modicon معرفی شد و هنوز هم در سال ۲۰۲۶ یکی از پرکاربردترین پروتکل‌های ارتباطی در سیستم‌های کنترل صنعتی (ICS) است. سادگی و قابلیت اطمینان آن باعث شده که علی‌رغم قدیمی بودن، در اکثر PLC ها ، RTUها و دستگاه‌های صنعتی استفاده شود.

---
انواع Modbus

Modbus در چهار حالت اصلی پیاده‌سازی می‌شود:

1. Modbus RTU 
   - فرمت باینری فشرده 
   - مناسب ارتباط سریال (RS-232 / RS-485) 
   - سرعت بالا و پرکاربرد در محیط‌های صنعتی 
   - دارای CRC16 برای چک integrity

2. Modbus ASCII 
   - فرمت متنی (هفت‌بیت) 
   - قابل خواندن توسط انسان 
   - کندتر از RTU و بیشتر برای دیباگ استفاده می‌شود

3. Modbus TCP (رایج‌ترین در حال حاضر) 
   - نسخه مبتنی بر TCP/IP 
   - استفاده از پورت ۵02 
   - فاقد CRC (چون TCP خودش checksum دارد) 
   - مناسب شبکه‌های Ethernet و IIoT

4. Modbus UDP 
   - نسخه بدون اتصال (Connectionless) 
   - سرعت بالاتر اما بدون تضمین تحویل 
   - کمتر استفاده می‌شود

---

ساختار دقیق Modbus TCP Packet

Modbus TCP از دو بخش اصلی تشکیل شده است:

1. MBAP Header (7 بایت)

- Transaction Identifier (2 بایت): برای تطبیق درخواست و پاسخ
- Protocol Identifier (2 بایت): همیشه 0x0000
- Length (2 بایت): طول بخش بعدی (Unit ID + PDU)
- Unit Identifier (1 بایت): آدرس Slave (معمولاً 1)

2. PDU (Protocol Data Unit)

- Function Code (1 بایت)
- Data (طول متغیر)

مثال کامل یک پکت Read Holding Registers (Function 03):

Transaction ID : 00 01
Protocol ID    : 00 00
Length         : 00 06
Unit ID        : 01
Function Code  : 03
Starting Address: 00 00
Quantity       : 00 0A

---

Function Code های حساس و خطرناک

به ترتیب (function code ، عنوان ، سطح ، هدف)

01 / 02   | Read Coils / Discrete Inputs     | متوسط   | Reconnaissance              

03 / 04   | Read Holding / Input Registers   | بالا     | Data Leakage                    

05 / 06    | Write Single Coil / Register     | بسیار بالا | Command Injection / Actuator Control

15 / 16    | Write Multiple Coils / Registers | بسیار بالا | Mass Control / Process Manipulation

08     | Diagnostics | بالا     | DoS, Device Reset               

43 (0x2B)    | Encapsulated Interface Transport | بسیار بالا | Backdoor, Vendor-Specific RCE

---

حملات واقعی و معروف روی پروتکل Modbus

- Stuxnet (2010): اولین حمله سایبری فیزیکی تاریخ. از Modbus برای تغییر فرکانس سانتریفیوژهای غنی‌سازی اورانیوم استفاده کرد.
- Industroyer / CrashOverride (2016): حمله به شبکه برق اوکراین. از Modbus TCP برای کنترل Breakerها و ایجاد blackout استفاده شد.
- Oldsmar Water Attack (2021): مهاجم از طریق اینترنت به سیستم SCADA شهر Oldsmar فلوریدا نفوذ کرد و با Modbus مقدار سدیم هیدروکسید (سود سوزآور) را به شدت افزایش داد.
- حملات متعدد گروه‌های APT (مانند Sandworm و APT33) در سال‌های ۲۰۲۳–۲۰۲۶ که عمدتاً از Write Function Codeها (05, 06, 15, 16) برای دستکاری فرآیندهای فیزیکی استفاده کرده‌اند.

---

تکنیک‌های حمله و Payload های واقعی

1. Reconnaissance (Function 03)

# خواندن 100 رجیستر اول
packet = b'\x00\x01\x00\x00\x00\x06\x01\x03\x00\x00\x00\x64'

2. Write Single Register (Function 06) — کنترل مستقیم

# تغییر مقدار یک رجیستر به حداکثر (مثلا سرعت موتور)
payload = struct.pack(">HH", 0x0000, 0xFFFF)   # Address 0, Value 65535

3. Mass Write (Function 16) — کنترل

# نوشتن 20 رجیستر با مقادیر خطرناک
values = [0xFFFF] * 20
payload = struct.pack(">HH", 0x0000, 20) + struct.pack(">" + "H"*20, *values)

4. DoS و Crash Payload
- ارسال PDU با Length Field بسیار بزرگ یا صفر
- Function Code های نامعتبر (0x80 تا 0xFF)
- می توان به Payload های بسیار طولانی (بیش از ۲۵۰ بایت) هم اشاره کرد
- تکرار سریع درخواست‌ها با همان Transaction ID

5. Replay Attack
ضبط پکت‌ها و پخش مجدد آنها در زمان مناسب برای ایجاد اختلال فیزیکی.

A powerful Modbus fuzzer designed for penetration testing this protocol is currently under development and will be released on the channel by next week Additionally a GSM fuzzer will be uploaded to the channel within the next two weeks.

♻️ In this update, we added a testing feature to the robot so that you, our valued users, can use this feature to test the robot for 7 days and then purchase your subscription with confidence.

🌐 USER :(t.me/Hacker_Leslie_bot?start)V7

modbus fuzzer

fix and debugged with ai !

for ics/scada attacks

What does this Modbus fuzzer do, and what features does it offer?
This fuzzer is designed for the Modbus protocol (Modbus was explained in earlier posts).
It incorporates 30 techniques for automated testing of the protocol and can exploit 10 common Modbus vulnerabilities.
Key features:
Network scanning with threading

Multi-threaded fuzzing

30 diverse fuzzing techniques

Detection of 10 types of vulnerabilities

Crash detection via heartbeat

Function code descriptions

Configurable delay

input Custom payloads

Technique selection

Comprehensive final report

Dynamic settings

Custom packet transmission

Single-device testing

Comprehensive error handling

No external module dependencies

Random transaction IDs

Automatic stop management

ok i will develop it

please support me in the future work I will be doing❤️

Updated; version 3.0.0 will be available soon.

ring 0 rootkit created and will be available soon.

modbus fuzzer is updated!
version 3.0.0

2 techniques added to tool
fix and debugged features

The tool was renamed "volt fuzzer" in version 4.0.0.

In version 4.0.0, the tool is capable of scanning and fuzzing vulnerabilities across two protocols (the DNP3 protocol has been added).

More than 10 new techniques have been added in version 4.0.0.

After about two weeks of patching, debugging, and fixing the codes the first version of phoenix_rk is finally being uploaded tonight.

I have now completed and released the rootkit I previously promised to develop.

Next is the deployment file; it has specific execution requirements, but its purpose is to allow you to easily control the rootkit without the hassle of manually launching it. However, for this to work, parts 2 through 6 must be compiled and converted into drivers.

Additionally, all vulnerable drivers must be placed in the drivers folder. This project—phoenix_root—is part of the massive nightfury project 💤.

Instructions:

Vulnerable drivers: RTCore64.sys AsrDrv.sys GLCKIO2.sys

After placing the vulnerable drivers into the drivers folder (located within the compiled driver directory derived from parts 2 through 6), you must compile phoenix_service.c and place the resulting executable file in the same root folder where the deployment file is located.

You may add a client if needed, and you can utilize a C2 (Command & Control) system of your choice.

The Telnet password for the remote control panel is nightfury_admin_2026.