EtherTag – ICS

Challenge Scenario :

We’ve discovered an `EtherNet/IP controller` on the network

Your mission: connect to the device and retrieve the value of the FLAG tag. Can you extract the flag and prove your skills?

Target Host 154.57.164.71:31475

---

Reconnaissance

The initial phase of my reconnaissance focused on answering three fundamental questions:

• Who is the device ?
• what communication protocol is used ?
• What is PLC type ?

I first performed a TCP port scan against the target :

Results : 31475/tcp open unknown

The service returned no standard banner, indicating a proprietary or industrial protocol implementation

I proceeded with further investigation to identify the underlying service

Protocol Identification

EtherNet/IP/CIP confirmation

using pycomm3, I established a CIP session to verify the EtherNet/IP communication

from pycomm3 import CIPDriver

target = "154.57.164.71:31475"

with CIPDriver(target) as dev_conn:
    print(f">> session established successfully : {target}")

I confirmed TCP connectivity on port 31763, EtherNet/IP protocol presence, and CIP service availability

Device Identification

To identify the device type and manufacturer, I required CIP identity object

from pycomm3 import LogixDriver

target = "154.57.164.71:31475"

with LogixDriver(target, init_tags=False) as plc:
    print("Controller Information: ")
    for key, value in plc.info.items():
        print(f"    [+] {key}: {value}")

Device Details :

• Manufacturer : Rockwell Automation/Allen-Bradley
• Device Type : Programmable Logic Controller
• Model : 1756-L61/B LOGIX5561
• Firmware Revision : 20.11
• Series : ControlLogix
• Protocol : EtherNet/IP (CIP)

---

As required by the challenge scope, I accessed the target and retrieved the flag

Security Impact

This challenge illustrates a common ICS security concern:

Information Disclosure :

Industrial devices frequently expose metadata through CIP identity services, including:

• Device model
• Firmware version
• Controller names
• Operational descriptions

If exposed externally, this information can support:

• Asset discovery
• Network mapping
• Technology fingerprinting
• Targeted vulnerability research

---

This exercise demonstrates how industrial device metadata alone can provide valuable information to an attacker and reinforces the importance of minimizing exposed information within ICS environments