Lion Cipher Lab

Program a PLC and watch an unauthenticated Modbus write flip its output — OpenPLC (no hardware)

• SOC Analyst / Blue Team
• Intermediate
• ~1 hour (most of it OpenPLC's one-time install)
• Free · no account required

Why it matters

The water plant that keeps your tap running, the elevator in your building, the bottling line at a factory, the power substation down the road -- the physical part of all of it is driven by small ruggedized computers called PLCs (Programmable Logic Controllers). A PLC reads INPUTS (a level sensor, a start button, a limit switch), runs a little program, and drives OUTPUTS (a pump motor, a valve, a light) -- over and over, dozens of times a second. This is OPERATIONAL TECHNOLOGY (OT): computers that move matter and energy in the real world, as opposed to the ordinary INFORMATION TECHNOLOGY (IT)…

What you'll learn

• explaining in plain English what OT, ICS, and a PLC are, and why a PLC is the small ruggedized computer that actually drives physical processes (pumps, valves, motors) by reading inputs and setting outputs
• reading the core PLC vocabulary as concrete things: ladder logic and Structured Text (how a PLC is programmed), a coil and a register (the bits and words it exposes), an HMI (the operator screen), and the scan cycle (read inputs, run logic, write outputs, repeat)
• installing and running the FREE, open-source OpenPLC Runtime on your own machine (Docker image or git install) and reaching its web interface at http://localhost:8080
• writing, uploading, and compiling a tiny IEC 61131-3 Structured Text program and STARTING a soft PLC, then watching its I/O live on the Monitoring page
• understanding Modbus/TCP: the 1979 industrial protocol most PLCs still speak, its coil/discrete-input/holding-register data model, and the fact that it carries NO authentication and NO encryption by design
• running a plain Modbus client (pymodbus in Python, or mbpoll) and using function code 05 (Write Single Coil) to command a PLC output with ZERO credentials
• proving the whole lesson: an attacker who can merely reach the OT network needs no password to flip a physical output, and watching that write land on the PLC's Monitoring page
• explaining the real defenses -- network segmentation (the Purdue model), Modbus anomaly/IDS monitoring, restricting write function codes, and authenticated/TLS gateways -- and why 'just add a password to Modbus' is not an available fix

Steps in this lab

1. First, the safety rule: this is a 100% virtual PLC on YOUR computer
2. The words you need: OT, ICS, PLC, ladder logic, Structured Text, coil, register, Modbus, HMI
3. Install and start the OpenPLC Runtime on your machine
4. Log in to the OpenPLC web interface (your HMI)
5. Write a tiny PLC program: a self-latching motor
6. Turn on Modbus, start the PLC, and confirm the motor is OFF
7. THE ATTACK: write a coil with no password and watch the output flip
8. Why it worked: Modbus has no authentication, by design
9. The defenses that actually work (and why 'just add a password' isn't one)
10. What you did and why it matters

Open the full interactive lab →