search

mushorg / conpot

ICS/SCADA honeypot
GNU General Public License v2.0
1.22k stars 413 forks source link

Exception caught DissectException: proto:s7comm reason:malformed variable header structure #452

Open simonsigre opened 5 years ago

simonsigre commented 5 years ago

When testing the s7 using a S7-1200 PLC Control commands to issue a stop conpot faults with error;

ERROR:conpot.protocols.s7comm.s7_server:Exception caught DissectException: proto:s7comm reason:malformed variable header structure, remote: 127.0.0.1. (b152ec52-4957-4027-8b5a-8191c708066c)
Traceback (most recent call last):
  File "/home/conpot/.local/lib/python3.6/site-packages/conpot-0.6.0-py3.6.egg/conpot/protocols/s7comm/s7_server.py", line 94, in handle
    cotp_cr_request = COTP_ConnectionRequest().dissect(cotp_base_packet.payload)
  File "/home/conpot/.local/lib/python3.6/site-packages/conpot-0.6.0-py3.6.egg/conpot/protocols/s7comm/cotp.py", line 106, in dissect
    raise ParseException('s7comm', 'malformed variable header structure')
conpot.protocols.s7comm.exceptions.ParseException: DissectException: proto:s7comm reason:malformed variable header structure
2019-04-25 10:36:46,487 Exception caught DissectException: proto:s7comm reason:malformed variable header structure, remote: 127.0.0.1. (b152ec52-4957-4027-8b5a-8191c708066c)
Traceback (most recent call last):
  File "/home/conpot/.local/lib/python3.6/site-packages/conpot-0.6.0-py3.6.egg/conpot/protocols/s7comm/s7_server.py", line 94, in handle
    cotp_cr_request = COTP_ConnectionRequest().dissect(cotp_base_packet.payload)
  File "/home/conpot/.local/lib/python3.6/site-packages/conpot-0.6.0-py3.6.egg/conpot/protocols/s7comm/cotp.py", line 106, in dissect
    raise ParseException('s7comm', 'malformed variable header structure')
conpot.protocols.s7comm.exceptions.ParseException: DissectException: proto:s7comm reason:malformed variable header structure

The datastream sent was;

...#.............SIMATIC-ROOT-ES..
.......r...1........... 6......................i...ServerSession_1c9c380..!..,1:::6.0::TCP/IP -> Intel(R) PRO/1000 MT N.....(.....).....*...HACK-PC_882330..+.....,........-..............i...SubscriptionContainer......r...