Skip to content

Lab Setup

Jump to bottom
André Henrique edited this page Jun 8, 2026 · 1 revision

Lab Environment Setup

IXF includes a Docker-based ICS/OT laboratory generator that deploys safe, isolated honeypot targets for testing modules without risk to real infrastructure.

Table of Contents

Quick Start

# Generate lab files and start
ixf > use assessment/lab_environment_setup
ixf (ICSLab) > set INCLUDE_CONPOT true
ixf (ICSLab) > set INCLUDE_FUXA true
ixf (ICSLab) > set OUTPUT_DIR /tmp/ics_lab
ixf (ICSLab) > run

[+] ICS/OT lab files generated in: /tmp/ics_lab
    docker-compose.yml     Docker services definition
    setup.sh               Automated setup script
    LAB_NOTES.md           Lab exercises guide

[*] Start: cd /tmp/ics_lab && bash setup.sh
[*] Stop:  docker compose down
cd /tmp/ics_lab && bash setup.sh

[*] Pulling Docker images...
[*] Starting Conpot (172.20.0.10)...
[*] Starting FUXA SCADA (172.20.0.20)...
[+] Lab ready.

    Conpot Modbus:    172.20.0.10:502
    Conpot S7comm:    172.20.0.10:102
    Conpot HTTP:      http://172.20.0.10
    FUXA HMI:         http://localhost:1881

Components

Conpot

Conpot is a low-interaction ICS honeypot that simulates industrial devices.

  • Modbus TCP: port 502 - accepts read/write requests, simulates holding registers and coils
  • S7comm: port 102 - simulates a Siemens S7-200 PLC
  • HTTP: port 80 - serves a Siemens-style web interface
  • SNMP: port 161 - responds with industrial device OID values
  • BACnet: port 47808 - simulates a BACnet controller

Safe target for: ransomware modules, write exploits, scanner modules, MiTM proxy, PCAP capture.

Limitations: Conpot returns static responses - it does not simulate real process effects. The register values do not change based on physical state.

FUXA SCADA

FUXA is an open-source SCADA/HMI web application.

  • Web HMI: http://localhost:1881
  • Supports Modbus TCP, S7, OPC UA data sources
  • Renders process displays and trends
  • Can connect to Conpot as its Modbus data source

Useful for: testing HMI-layer attacks, SCADA web vulnerabilities, CVE-2026-25895 (FUXA RCE).

Lab Setup Module

Path: assessment/lab_environment_setup

Full options

ixf > use assessment/lab_environment_setup
ixf (ICSLab) > show options

Name              Value    Description
INCLUDE_CONPOT    true     Deploy Conpot ICS honeypot
INCLUDE_FUXA      true     Deploy FUXA SCADA/HMI
INCLUDE_OPENPLC   false    Deploy OpenPLC Runtime (optional)
NETWORK_SUBNET    172.20.0.0/24  Lab network subnet
CONPOT_IP         172.20.0.10  Conpot container IP
FUXA_IP           172.20.0.20  FUXA container IP
OUTPUT_DIR        /tmp/ics_lab  Output directory for generated files

With OpenPLC

ixf (ICSLab) > set INCLUDE_OPENPLC true
ixf (ICSLab) > run

[+] Additional component: OpenPLC Runtime
    OpenPLC Modbus: 172.20.0.30:502
    OpenPLC WebIDE: http://localhost:8080
    Default login:  openplc / openplc

[*] OpenPLC executes real PLC ladder logic (IEC 61131-3)
[*] Registers change based on the loaded program

Manual Docker Compose

If you prefer to build the lab manually:

# docker-compose.yml
version: '3.8'

networks:
  ics_lab:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/24

services:
  conpot:
    image: mushorg/conpot:latest
    networks:
      ics_lab:
        ipv4_address: 172.20.0.10
    ports:
      - "80:80"
      - "502:502"
      - "102:102"
    restart: unless-stopped

  fuxa:
    image: frangoteam/fuxa:latest
    networks:
      ics_lab:
        ipv4_address: 172.20.0.20
    ports:
      - "1881:1881"
    restart: unless-stopped
docker compose up -d
docker compose ps     # verify all containers running
docker compose down   # stop and remove containers

Lab Exercises

Exercise 1 - Module discovery

# Scan the Conpot honeypot
ixf > use scanners/ics/modbus_detect
ixf (ModbusDetect) > set TARGET 172.20.0.10
ixf (ModbusDetect) > check
# Expected: Siemens S7-200 device identification from Conpot

Exercise 2 - Register enumeration

ixf > use assessment/protocols/modbus_read_holding
ixf (ModbusRead) > set TARGET 172.20.0.10
ixf (ModbusRead) > set COUNT 50
ixf (ModbusRead) > run
# Read 50 registers and understand the register map

Exercise 3 - Ransomware simulation (simulate mode)

ixf > use exploits/ransomware/plc_project_locker
ixf (PLCProjectLocker) > set TARGET 172.20.0.10
ixf (PLCProjectLocker) > run
# Review what a real attack would do - in simulate mode only

Exercise 4 - PCAP analysis

# Start capture in background
Start-Process -NoNewWindow tcpdump -ArgumentList "-i", "any", "-w", "/tmp/lab_session.pcap", "'tcp port 502'"

# Run several modules against Conpot (simulate mode)
ixf > use scanners/ics/modbus_unit_scan
ixf (ModbusUnitScan) > set TARGET 172.20.0.10
ixf (ModbusUnitScan) > run

# Analyze results
ixf > use assessment/detection/modbus_pcap_analyzer
ixf (ModbusPCAP) > set PCAP_FILE /tmp/lab_session.pcap
ixf (ModbusPCAP) > run

Exercise 5 - Generate and validate detection rules

# Generate Suricata rules
ixf > use assessment/detection/suricata_ot_rules_generator
ixf (SuricataOT) > set OUTPUT_FILE /tmp/ics_rules.rules
ixf (SuricataOT) > run

# Test rules against the captured session
suricata -r /tmp/lab_session.pcap -S /tmp/ics_rules.rules -l /tmp/suricata_out/
cat /tmp/suricata_out/fast.log

Connecting IXF to the Lab

Set the default lab target before starting a session:

# All modules will default to Conpot
ixf > setg TARGET 172.20.0.10
ixf > setg PORT 502

# Now use any Modbus module without re-entering target
ixf > use scanners/ics/modbus_detect
ixf (ModbusDetect) > check    # uses 172.20.0.10:502 from global

Conpot Detection

After working with the lab, use the Conpot detection module to verify the honeypot fingerprint:

ixf > use assessment/detection/conpot_integration
ixf (ConpotDetect) > set TARGET 172.20.0.10
ixf (ConpotDetect) > run

[*] Scanning 172.20.0.10 for Conpot honeypot indicators
[*] Modbus FC43: vendor=Siemens, model=S7-200 [GENERIC - SUSPECT]
[*] HTTP /index.html: default Conpot template detected [CONFIRMED]
[!] VERDICT: High confidence Conpot honeypot (2/3 indicators)

This module is useful in real assessments to identify whether a target is a honeypot before running live exploits.

Author: Andre Henrique (@mrhenrike) | Uniao Geek | https://uniaogeek.com.br/

Clone this wiki locally