OT/ICS Security Lab: Modbus TCP Security Assessment & PLC Attack Simulation

OT/ICS cybersecurity lab designed for Modbus TCP security assessment and PLC attack simulation, built in a controlled, isolated environment for training and ethical security research purposes.

Context

This project reproduces a minimal industrial control architecture (PLC + process simulator) to study, in a controlled setting, the vulnerabilities inherent to the Modbus TCP protocol: lack of authentication, lack of encryption, and acceptance of unvalidated commands by the PLC.

Project Structure

Document	Content
LAB1-deployment.md	Deployment of the OT infrastructure (CODESYS PLC + Factory I/O), Modbus TCP configuration, Ladder logic
LAB2-exploitation.md	Reconnaissance, MITM (ARP poisoning), Wireshark analysis, Python exploitation, impact assessment, MITRE ATT&CK mapping

.
├── README.md
├── LAB1-deployment.md
├── LAB2-exploitation.md
├── exploit.py        # Modbus command injection tool used in LAB 2
├── figure-lab1/     # Screenshots referenced in LAB1-deployment.md
└── figure-lab2/     # Screenshots referenced in LAB2-exploitation.md

Architecture

+------------------+    Modbus TCP (502)     +-------------------+
|  CODESYS PLC     | <---------------------> |  Factory I/O      |
|  192.168.100.12  |                         |  192.168.100.11   |
|  (Server)        |                         |  (Client)         |
+------------------+                         +-------------------+

• PLC: CODESYS Control Win V3, Modbus TCP server, Ladder Diagram logic
• Process simulation: Factory I/O, "From A to B" scene (conveyor + presence sensor)
• Network: VMware Host-Only, isolated, 192.168.100.0/24

Lab Summary

LAB 1: Deployment

• Configured a CODESYS SoftPLC with a Modbus TCP server
• Programmed Ladder Diagram logic for conveyor control
• Integrated Factory I/O as an industrial process simulator
• Validated Modbus TCP communication and safety logic

LAB 2: Exploitation

• Performed network reconnaissance (Nmap)
• Conducted an ARP spoofing (MITM) attack with Ettercap
• Captured and analyzed Modbus TCP traffic with Wireshark: reverse-engineered the Coil/Discrete Input mapping
• Developed a Python tool to inject Modbus commands (Write Single Coil, FC 0x05)
• Demonstrated the impact of unauthorized Modbus commands on the PLC-controlled process
• Mapped the attack chain to MITRE ATT&CK for ICS

Exploitation Tool

The Python exploitation script developed for this project is included in this repository: exploit.py.

Disclaimer

This project was carried out exclusively in a virtualized, isolated, and controlled environment for educational purposes. The techniques shown (ARP poisoning, Modbus command injection) must never be applied to real systems without explicit authorization. Doing so is illegal and can cause serious physical consequences on real industrial installations.