Error in log and snap7 can't receive avaliable messages from conpot

[lemorn]

Hello! I met a problem when I ran conpot in default template. When I run conpot on my cloud server(OS is Ubuntu and the conpoot version is 0.6.0), a error appeared: and my snap7 can't receive avaliable messages about this "S7-PLC". How can I solve these?

I also want to know if i can deploy a new honeypot (like mitsubish IQ-R PLC) by conpot? Which part of the code should I modify to deploy a new honeypot?If I want to modify some messgaes sent by conpot, such as type of cpu, what should I do?

And there seems to be a small problem. When running the docker container, there seems to be some problems with the port mapping. After running the container, it shows that these ports are opened. But as far as I know, the ports corresponding to s7, modbus, and http should be 102, 502, and 80. Maybe this has any special purpose?

Thank you very much!

[glaslos]

1) what requests are you sending causing the error? 2) have a look into the conpot/templates folder. It should give you an idea how to emulate devices 3) check the conpot/templates folder and the files inside. You can also use docker-compose to run the container.

[Han-zb]

1. "snap7 can't receive avaliable messages", this is probably because the conpot is emulating a s7-200 PLC, different series of plc needs different connection codes when sending s7comm, tpkt and cotp, you can have a try using the codes below:

   
   import socket

connection= ("ip", port)

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.connect(connection)

Connect plc

cotp_conn_str = "0300001611e00000000600c1020100c2020102c0010a" cotp_conn = bytes.fromhex(cotp_conn_str) sock.sendall(cotp_conn) data = sock.recv(1024) print("response to cotp: ", data)

s7_conn_str = "0300001902f08032010000ccc100080000f0000001000103c0" s7_conn = bytes.fromhex(s7_conn_str) sock.sendall(s7_conn) data2 = sock.recv(1024) print("response to s7_conn: ", data2)

Send requests

req_str = "0300002102f080320700001200000800080001120411440100ff090004001c0000"#unit info req = bytes.fromhex(req_str) sock.sendall(req) data3 = sock.recv(1024) print("response to request: ", data3)

2. the conpot is running in the docker, the ports 5020, 10201, 8800 are the docker container ports. And when you first create a container to run conpot using command
`docker run -it -p 80:8800 -p 102:10201 -p 502:5020 -p 161:16100/udp --network=bridge honeynet/conpot:latest /bin/sh` 
actually there is a port mapping, you can modified them in the templates/default/***/***.xml

[soso288]

@Han-zb I don't really understand where to put your code. I tried putting it in init.py but I got a connection refused error.

Also can you tell me how to correctly modify the s7comm.xml file, so that I get similar output when usind plcscan?

223.171.35.149:102 S7comm (src_tsap=0x100, dst_tsap=0x102) Module : 6ES7 312-1AE14-0AB0 v.0.7 (36455337203331322d31414531342d304142302000c000070001) Basic Hardware : 6ES7 312-1AE14-0AB0 v.0.7 (36455337203331322d31414531342d304142302000c000070001) Basic Firmware : v.3.3.12 (202020202020202020202020202020202020202000c05603030c) Unknown (129) : Boot Loader A% (426f6f74204c6f61646572202020202020202020000041250c0c)

I tried editing the file with the information above but I get this error in plcscan:

Scan start...
127.0.0.1:10201 [Errno 104] Connection reset by peer 127.0.0.1:10201 S7comm (src_tsap=0x100, dst_tsap=0x102) [ERROR][S7Protocol] Unknown TPKT format [ERROR][S7Protocol] Unknown TPKT format Scan complete

and this in conpot:

ERROR:conpot.protocols.s7comm.s7_server:Exception caught , remote: 127.0.0.1. (775b5d19-d071-48ab-8e1d-d8504e9b7f41) Traceback (most recent call last): File "/home/soso/conpot/lib/python3.6/site-packages/conpot/protocols/s7comm/s7_server.py", line 170, in handle response_param, response_data = S7_packet.handle() File "/home/soso/conpot/lib/python3.6/site-packages/conpot/protocols/s7comm/s7.py", line 62, in handle return self.param_mapping[self.param][1]() File "/home/soso/conpot/lib/python3.6/site-packages/conpot/protocols/s7comm/s7.py", line 157, in request_diagnostics description, params, data = m(data_ssl_index) File "/home/soso/conpot/lib/python3.6/site-packages/conpot/protocols/s7comm/s7.py", line 181, in request_ssl_17 str_to_bytes(self.data_bus.get_value(current_ssl['W#16#0001'])), File "/home/soso/conpot/lib/python3.6/site-packages/conpot/core/databus.py", line 43, in get_value assert key in self._data AssertionError