4840 - OPC Unified Architecture - HackTricks

# 4840 - Pentesting OPC UA

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

## Basic Information

OPC UA, standing for Open Platform Communications Unified Access, is a crucial open-source protocol used in various industries like Manufacturing, Energy, Aerospace, and Defence for data exchange and equipment control. It uniquely enables different vendors' equipment to communicate, especially with PLCs.

Its configuration allows for strong security measures, but often, for compatibility with older devices, these are lessened, exposing systems to risks. Additionally, finding OPC UA services can be tricky since network scanners might not detect them if they're on nonstandard ports.

Default port: 4840

    PORT     STATE SERVICE REASON
    4840/tcp open  unknown syn-ack

## Pentesting OPC UA

To reveal security issues in OPC UA servers, scan it with OpalOPC.

    opalopc -vv opc.tcp://$target_ip_or_hostname:$target_port

### Exploiting vulnerabilities

If authentication bypass vulnerabilities are found, you can configure an OPC UA client accordingly and see what you can access. This may allow anything from merely reading process values to actually operating heavy-duty industrial equipment.

To get a clue of the device you have access to, read the "ServerStatus" node values in the address space and google for a usage manual.

## Shodan

- `port:4840`

## References

- https://opalopc.com/how-to-hack-opc-ua/

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.