> For the complete documentation index, see [llms.txt](https://davidtancredi.gitbook.io/pentesting-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/enumeration/modbus-502.md).

# Modbus 502

Quick script to enumerate all things Modbus

```
import os

print(" ***** ModbusCracker.py by R3dcl1ff ***** ") 

#Prompt user to enter target IP
target_ip = input("Enter the IP address of the target: ")

#Run modbus specific nmap scripts
os.system(f"nmap --script=modbus-* {target_ip} -p 502")

#Invoke metasploit and run modbus specific enumeration modules against the target
os.system(f"msfconsole -q -x 'use auxiliary/scanner/scada/modbus_banner_grabbing; set RHOSTS {target_ip}; set RPORT 502 ; run; use auxiliary/scanner/scada/modbusdetect ; set RHOSTS {target_ip}; set RPORT 502 ; set UNIT_ID 1; run; use auxiliary/scanner/scada/modbus_findunitid ;set RHOSTS {target_ip}; set RPORT 502 ; set BENICE 2 ; set UNIT_ID_FROM 1 ; set UNIT_ID_TO 25 ; run; exit;' > output.txt")

print(" ***** Metasploit Enumeration Output ***** ")

#Print the contents of output.txt to stdout
with open("output.txt", "r") as f:
    print(f.read())

print("Enumeration complete! Check output.txt for results.")

```