Inside OpenPLC Runtime v4: Establishing a Security Research Baseline

Описание и применение

Создана базовая карта среды выполнения OpenPLC Runtime v4, включая процессы, сокеты, сетевые интерфейсы и привилегии, что обеспечивает основу для дальнейших исследований безопасности.

Задача

Understand the runtime environment of OpenPLC Runtime v4 before conducting deeper security tests.

Результат

A comprehensive baseline of OpenPLC Runtime v4’s runtime processes, communication interfaces, Linux environment, and recovery behavior was established, providing a reference for future security investigations.

Рабочий процесс

• 1. Start Docker container with image ghcr.io/autonomy-logic/openplc-runtime:latest and publish ports 8443 and 502.
• 2. Inspect /proc, /sys, and filesystem to list processes, threads, and executable paths.
• 3. Record process names, PIDs, and thread counts.
• 4. Terminate plc_main to observe supervisor recovery and state transition.
• 5. Enumerate local Unix-domain sockets and their paths.
• 6. Use ss to list network listeners inside container.
• 7. Check file permissions, ownership, and modes for executables and runtime files.
• 8. Inspect Linux capabilities of processes.
• 9. Review open file descriptors and device nodes in /dev.

Доказательства

I started the container with the runtime image and published ports for the web interface and Modbus TCP:

Источник

The container's initial process, PID 1, ran the Python web management application through its virtual environment.

Источник

I then deliberately terminated plc_main to observe what happened. The supervisor reported an unexpected exit with code -9 and attempted to restart the process.

Источник

I used ss to inspect the network sockets visible inside the container's network namespace.

Источник