RowdyHacks XII: Dutiful Maid Troubles

Challenge

ICS/OT · 200 points. The prompt asks us to "change a machine's conditions to recover its output," over the same OT gateway and tunnel as the other Touhou OT challenges (local ports 1500-1503).

Approach

Through the tunnel, 127.0.0.1:1502 answered Modbus/TCP. Reading holding registers 10-29 (function 3) initially returned twenty zeros, and coil 0 (function 1) read off. The challenge is explicit that a condition must change, so I flipped coil 0 on with a single function-5 write, then re-read the registers:

write coil 0 ON : 37050000000601050000ff00
registers 10-29 -> 114 111 119 100 121 123 78 49 71 72 84 79 70 77 79 68 66 85 83 125
                   ->  r o w d y { N 1 G H T O F M O D B U S }

Each register's byte is ASCII, spelling the flag. Writing coil 0 off again (...0500000000) restored the original state and the registers returned to zero. The solver does this in a finally block so the device is left as it was found.

Takeaway

This is the one that should worry a defender: a single unauthenticated function-5 coil write changed process state and produced new output, and on a real control system that same primitive actuates a valve, a relay, or a pump. Traditional Modbus/TCP writes carry no authentication, so the controls are network-level, segmentation and read-only data diodes where possible, plus an alert on any write function from anything but the authorized controller. Restoring the coil after testing is basic OT discipline; an attacker would not.

Flag

rowdy{N1GHTOFMODBUS}