Nakatomi Space: Lateral Movement as L1 Post-exploitation in OT
summary
Demonstration exploits a pre-auth FTP stack overflow on a Wago 750 to proxy Modbus, replays UMass authentication and abuses an undocumented UMass CSA 0x50 command to copy data blocks into executable PLC memory for RCE on a Schneider M340, then triggers an Urgent11-style TCP/IP options overflow to achieve RCE on a GuardLogix 1756-N2TD Ethernet module. The chain achieves safety bypasses and backplane control, runs stealthy implants without restarts, and has coordinated advisories and mitigations.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 0:38The Purdue Model and OT
- 2:51Network Crawl Spaces
- 4:48ICS and SIS Integration
- 8:11Third-Party Packaged Units
- 10:24Granular Control Issues
- 12:48Vendor and Standards View
- 13:30POC Attack Scenario
- 18:38Exploiting the Coupler
- 22:16Schneider PLC Vulnerability
- 25:12Malicious PLC Firmware
- 29:09Lateral Movement to Field
- 30:28Safety System Hacking
- 33:07Attack Demonstration
- 36:58Vulnerability Disclosure
- 38:10Mitigation and Forensics
- 39:45Conclusion
- 40:56Q&A
related talks
29mFrom an URGENT/11 Vulnerability to a Full Take-Down of a Factory, Using a Single Packet
51mIndustrial Control Systems : Pentesting PLCs 101 (Part 2/2)
38mAbusing CNC Technologies
21mOops, It Halted Again: Exploiting PLC Memory for Fun and Profit in Industrial Control...
36mWhen The Front Door Becomes a Backdoor: The Security Paradox of OSDP
39mNight of the living vulnerabilities
36mAlarm.DISARM - Remotely Exploiting & Disarming Popular Physical Security System from Public Internet
46mAn OT Cyber attack simulation on a chemical plant