Enumerating ProConOS devices
ProConOS is a PLC runtime engine designed for embedded or PC-based control applications. The protocol can be queried for system information without authentication and it returns information such as PLC type, project name, project source code name, and ladder logic runtime information.
This recipe shows you how to enumerate ProConOS PLCs with Nmap.
How to do it...
Open your terminal and enter the following Nmap command:
$nmap -Pn -sT -p20547 --script proconos-info <target>
The procons-info
script will obtain device information, as shown next:
PORT STATE SERVICE 20547/tcp open  ProConOS | proconos-info: |    LadderLogicRuntime: ProConOS V4.1.0230 Feb 4 2011 |    PLC Type: Bristol: CWM V05:40:00 02/04 |    Project Name: Test |    Boot Project: |_   Project Source Code: Test_2
How it works...
The proconos-info
script detects...