Skip to content

ICS_CTF Exploitation

The ICS CTF competition content comes from the author's own competition experience. If there are any inaccuracies, please forgive us.

An exploit provides multiple exploitation methods for a specific vulnerability. There can be many exploitation methods for a single vulnerability. In the ICS field, the most common exploitation methods currently include: configuration exploitation, communication hijacking, and Web penetration.

Configuration Exploitation

Configuration is the core of ICS scenarios and the key component of ICS programming and functionality implementation. If you are not familiar with configuration, please study relevant books on industrial control system configuration in the automation field on your own. The best way to learn is to obtain the relevant product manuals and study the content step by step.

Configuration exploitation methods:

  1. Forced I/O (the most effective debugging method)
  2. Project encryption and decryption (project encryption is a PLC protection measure, but it can still be cracked)
  3. Upload and download (please study the basic concepts on your own)
  4. Memory layout of target devices such as PLCs (please study the basic concepts on your own)
  5. Other additional features (e.g., FTP, NTP, etc.)

Communication Hijacking

Communication hijacking is the most classic exploitation method in ICS scenarios, including ARP hijacking, PLC/HMI communication hijacking, PLC session hijacking, PLC command execution, and more. Communication hijacking methods:

  1. ARP hijacking — ARP hijacking can disrupt communication between a PLC and other devices. Since projects may have hardcoded IPs and other interaction addresses, it may not always work, but it is worth trying.
  2. PLC/HMI communication hijacking — Using bypass devices to connect to or control PLC devices, forcing I/O rewrites or outputs.
  3. PLC command execution — The most sensitive aspect of ICS devices includes device crashes (unrecoverable), device start/stop, forced parameter updates, etc. These can have a significant impact on normal industrial processes.

Web Penetration

Target enterprises often have Web-based ICS applications, such as process display pages and user database pages. These are essentially no different from typical Web challenges.

  1. Weak passwords (fairly common in ICS; vendor default passwords on ICS devices)
  2. Command injection (fairly common; requires auditing Web application source code)
  3. Directory traversal (easy to test manually but hard to exploit; needs to be combined with upload functionality)
  4. Pre-installed backdoors (hard to discover; requires a combination of reverse engineering and Web penetration)
  5. SQL injection (relatively straightforward)
  6. XSS is basically useless here (rarely encountered)
  7. Project file disclosure (.git/.idea/.project and other project file leaks)