From HTTP to SSH: Finding a Host-Level Attack Path in OpenPLC v3

The investigative journey began with a software PLC, designed to run complex industrial control logic on a conventional computer rather than a physical controller. This change in architecture alters the security landscape, as the control logic interacts with the host operating system during storage, compilation, and loading.

The researcher focused on modifying the PLC's active control logic through its deployment environment, seeking to replace the existing program and execute the altered logic without going through the typical management workflow.

Initially, the researcher explored the Beremiz platform, but it proved challenging due to its complex architecture and communication mechanisms. After nearly nine hours of investigation, the researcher decided to shift targets.

The next target was OpenPLC v3, which offered a more accessible environment for the investigation. The researcher set up an isolated Ubuntu 24.04 virtual machine using Multipass, installing OpenPLC v3, its dependencies, and the runtime. The management dashboard was accessible via HTTP.

The researcher then proceeded to map the target's exposed services, identifying three key services: SSH, Modbus TCP, and an HTTP-based management dashboard. The SSH service became particularly important for remote administration.

The researcher focused on the management application, examining its endpoints and authentication process. Once logged in, the researcher used a Flask session cookie to explore the management workflow programmatically. The goal was to reproduce the program management and compilation sequence through HTTP requests, aiming to deliver and execute a modified control program.