RowdyHacks XII: Gensokyo Industry Standards

Challenge

ICS/OT · 50 points. The prompt asks for the TCP port number that the Modbus protocol uses, and fixes the answer format as rowdy{hey_its_<number>}.

Approach

Modbus is the canonical industrial-control protocol, and its application layer (MBAP, Modbus Application Protocol) listens on a single well-known port. Rather than trust memory, I confirmed it against the Nmap service registry that ships with Kali:

awk '$1 == "mbap" && $2 == "502/tcp" { print }' /usr/share/nmap/nmap-services

That line identifies 502/tcp as the Modbus Application Protocol. Dropping 502 into the required format produces the flag. No attachment or hint was needed.

Takeaway

Default service ports are reconnaissance, step one for both sides. Modbus lives on tcp/502, so it is the first thing to probe on an OT network and the first thing to watch, because traditional Modbus/TCP carries no native authentication and any host that can reach the port can speak to a PLC. A segmented OT network plus an alert on tcp/502 from anything but the engineering workstation turns "knows the port" back into a non-event.

Flag

rowdy{hey_its_502}