Participated in a SCTF competition, also wrote a WP, right is one. Because only one question was made .... , but also the simplest of the Modbus protocol topics. As a newly born CTF child, it is also very gratifying ... No matter how much you make, the summary is necessary, and you need to know it thoroughly.
1, first open the topic, downloaded to a packet. Open with Wireshark.
There is a lot of data stored in it. See the topic first Baidu a wave of Modbus, originally this is an industrial agreement.
来波这个协议的定义:Modbus 协议是应用于电子控制器上的一种通用语言。通过此协议,控制器相互之间、控制器经由网络(例如以太网)和其它设备之间可以通信。Modbus 协议定义了一个控制器能认识使用的消息结构,而不管它们是经过何种网络进行通信的。它描述了一控制器请求访问其它设备的过程,如何回应来自其它设备的请求,以及怎样侦测错误并记录。它制定了消息域格局和内容的公共格式。
Plainly, it's a request-answering protocol.
2, next use the display filter, filter out the Modbus protocol data. Convenient for us to check the relevant information
Get these things and I want to see what exactly is passing between the two devices in the communication value? We know that Wirwshark can be queried using trace streams. This uses the TCP trace stream. A TCP tracking stream can compose a small piece of data into an easy-to-read form.
TCP协议的一个可靠性:应用数据被分割成TCP认为最适合发送的数据块。
3. Tracking TCP Data streams
Click on the TCP stream to trace the data, or ctrl+alt+shift+t shortcut to track the TCP stream
Here we have chosen to see data sent from the client to the server or the server to the client. But the problem is that the data can be understood directly.
The official WP has come down, to study, although almost can not understand, but who let me is a in the world of CTF this small white?
I don't know how the big guys are going to change. What they have gone through ....
SCTF of a WP------MODBUS