neilphan98/hearth-rockwell repository overview

⁠HEARTH Rockwell MicroLogix

Allen-Bradley MicroLogix-style PLC: real EtherNet/IP + CIP PCCC (CVE-2018-17924 study).

Real-device analogue: A Rockwell/Allen-Bradley MicroLogix 1400 (or 1756 ENET) controller.

Protocol / ports: EtherNet/IP encapsulation + CIP (TCP 44818).

⁠What it does / how it works

Real EtherNet/IP with the CIP Execute-PCCC service (0x4B) for data-table read/write and the CIP TCP/IP Interface Object (class 0xF5) for the CVE-2018-17924 unauthenticated IP-config write that causes loss of communication. Framing verified against the real pycomm3 SLCDriver as a live client. Grounds the 2026 MicroLogix water-utility campaign.

⁠Functions

• EtherNet/IP + CIP (44818)
• PCCC data-table read/write (0x4B)
• CVE-2018-17924 IP-config write path

⁠How to use

With pycomm3 SLCDriver, connect to <ip> and read a data file (e.g. N7:0). Authorised study only.

⁠Use in GNS3

• Import the matching .gns3a (File > Import appliance), or docker pull neilphan98/hearth-rockwell:1.1.
• Drag onto your topology, wire to a switch/hub, start. Console: telnet.
• Adapters: 1. Category: guest.

IPv4 device: leave MQQ1_IP empty to auto-assign a unique IP (zero-config), or set a fixed address. Zone via HEARTH_OCTET (5 corp / 6 ot / 8 security).

⁠Default environment (per node)

MQQ1_IP=192.168.6.45
MQQ1_PREFIX=24
MQQ1_GW=192.168.6.1
MQQ1_IP6=fd11:1111:1111:6::2d
MQQ1_IP6_PREFIX=64
MQQ1_GW6=fd11:1111:1111:6::1

Current release: 1.1 (docker pull neilphan98/hearth-rockwell:1.1)

Part of the HEARTH Tower commercial-building IoT/OT security testbed. Image tags are immutable per release (1.0, 1.1, ...), so updating the device list never changes nodes you already placed. See the HEARTH bundle for all devices + guides.