1570 lines
52 KiB
Lua
1570 lines
52 KiB
Lua
local nmap = require "nmap"
|
|
local shortport = require "shortport"
|
|
local stdnse = require "stdnse"
|
|
local string = require "string"
|
|
local unicode = require "unicode"
|
|
|
|
description = [[
|
|
Discovers and enumerates BACNet Devices collects device information based off
|
|
standard requests. In some cases, devices may not strictly follow the
|
|
specifications, or may comply with older versions of the specifications, and
|
|
will result in a BACNET error response. Presence of this error positively
|
|
identifies the device as a BACNet device, but no enumeration is possible.
|
|
|
|
Note: Requests and responses are via UDP 47808, ensure scanner will receive UDP
|
|
47808 source and destination responses.
|
|
|
|
http://digitalbond.com
|
|
|
|
]]
|
|
|
|
---
|
|
-- @usage
|
|
-- nmap --script bacnet-info -sU -p 47808 <host>
|
|
--
|
|
-- @output
|
|
--47808/udp open bacnet
|
|
--| bacnet-discover:
|
|
--| Vendor ID: BACnet Stack at SourceForge (260)
|
|
--| Vendor Name: BACnet Stack at SourceForge
|
|
--| Instance Number: 260001
|
|
--| Firmware: 0.8.2
|
|
--| Application Software: 1.0
|
|
--| Object Name: SimpleServer
|
|
--| Model Name: GNU
|
|
--| Description: server
|
|
--|_ Location: USA
|
|
--
|
|
-- @xmloutput
|
|
--<elem key="Vendor ID">BACnet Stack at SourceForge (260)</elem>
|
|
--<elem key="Vendor Name">BACnet Stack at SourceForge</elem>
|
|
--<elem key="Object-identifier">260001</elem>
|
|
--<elem key="Firmware">0.8.2</elem>
|
|
--<elem key="Application Software">1.0</elem>
|
|
--<elem key="Object Name">SimpleServer</elem>
|
|
--<elem key="Model Name">GNU</elem>
|
|
--<elem key="Description">server</elem>
|
|
--<elem key="Location">USA</elem>
|
|
|
|
|
|
|
|
author = {"Stephen Hilt", "Michael Toecker"}
|
|
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
|
|
categories = {"discovery", "version"}
|
|
|
|
|
|
--
|
|
-- Function to define the portrule as per nmap standards
|
|
--
|
|
--
|
|
--
|
|
|
|
portrule = shortport.version_port_or_service(47808, "bacnet", {"udp","tcp"})
|
|
|
|
---
|
|
-- Table to look up the Vendor Name based on Vendor ID
|
|
-- Table data from http://www.bacnet.org/VendorID/BACnet%20Vendor%20IDs.htm
|
|
-- Fetched on 9/26/2015
|
|
--
|
|
-- @key vennum Vendor number parsed out of the BACNet packet
|
|
local vendor_id = {
|
|
[0] = "ASHRAE",
|
|
[1] = "NIST",
|
|
[2] = "The Trane Company",
|
|
[3] = "McQuay International",
|
|
[4] = "PolarSoft",
|
|
[5] = "Johnson Controls Inc.",
|
|
[6] = "American Auto-Matrix",
|
|
[7] = "Siemens Schweiz AG (Formerly: Landis & Staefa Division Europe)",
|
|
[8] = "Delta Controls",
|
|
[9] = "Siemens Schweiz AG",
|
|
[10] = "Schneider Electric",
|
|
[11] = "TAC",
|
|
[12] = "Orion Analysis Corporation",
|
|
[13] = "Teletrol Systems Inc.",
|
|
[14] = "Cimetrics Technology",
|
|
[15] = "Cornell University",
|
|
[16] = "United Technologies Carrier",
|
|
[17] = "Honeywell Inc.",
|
|
[18] = "Alerton / Honeywell",
|
|
[19] = "TAC AB",
|
|
[20] = "Hewlett-Packard Company",
|
|
[21] = "Dorsette.s Inc.",
|
|
[22] = "Siemens Schweiz AG (Formerly: Cerberus AG)",
|
|
[23] = "York Controls Group",
|
|
[24] = "Automated Logic Corporation",
|
|
[25] = "CSI Control Systems International",
|
|
[26] = "Phoenix Controls Corporation",
|
|
[27] = "Innovex Technologies Inc.",
|
|
[28] = "KMC Controls Inc.",
|
|
[29] = "Xn Technologies Inc.",
|
|
[30] = "Hyundai Information Technology Co. Ltd.",
|
|
[31] = "Tokimec Inc.",
|
|
[32] = "Simplex",
|
|
[33] = "North Building Technologies Limited",
|
|
[34] = "Notifier",
|
|
[35] = "Reliable Controls Corporation",
|
|
[36] = "Tridium Inc.",
|
|
[37] = "Sierra Monitor Corporation/FieldServer Technologies",
|
|
[38] = "Silicon Energy",
|
|
[39] = "Kieback & Peter GmbH & Co KG",
|
|
[40] = "Anacon Systems Inc.",
|
|
[41] = "Systems Controls & Instruments LLC",
|
|
[42] = "Lithonia Lighting",
|
|
[43] = "Micropower Manufacturing",
|
|
[44] = "Matrix Controls",
|
|
[45] = "METALAIRE",
|
|
[46] = "ESS Engineering",
|
|
[47] = "Sphere Systems Pty Ltd.",
|
|
[48] = "Walker Technologies Corporation",
|
|
[49] = "H I Solutions Inc.",
|
|
[50] = "MBS GmbH",
|
|
[51] = "SAMSON AG",
|
|
[52] = "Badger Meter Inc.",
|
|
[53] = "DAIKIN Industries Ltd.",
|
|
[54] = "NARA Controls Inc.",
|
|
[55] = "Mammoth Inc.",
|
|
[56] = "Liebert Corporation",
|
|
[57] = "SEMCO Incorporated",
|
|
[58] = "Air Monitor Corporation",
|
|
[59] = "TRIATEK LLC",
|
|
[60] = "NexLight",
|
|
[61] = "Multistack",
|
|
[62] = "TSI Incorporated",
|
|
[63] = "Weather-Rite Inc.",
|
|
[64] = "Dunham-Bush",
|
|
[65] = "Reliance Electric",
|
|
[66] = "LCS Inc.",
|
|
[67] = "Regulator Australia PTY Ltd.",
|
|
[68] = "Touch-Plate Lighting Controls",
|
|
[69] = "Amann GmbH",
|
|
[70] = "RLE Technologies",
|
|
[71] = "Cardkey Systems",
|
|
[72] = "SECOM Co. Ltd.",
|
|
[73] = "ABB Gebäetechnik AG Bereich NetServ",
|
|
[74] = "KNX Association cvba",
|
|
[75] = "Institute of Electrical Installation Engineers of Japan (IEIEJ)",
|
|
[76] = "Nohmi Bosai Ltd.",
|
|
[77] = "Carel S.p.A.",
|
|
[78] = "AirSense Technology Inc.",
|
|
[79] = "Hochiki Corporation",
|
|
[80] = "Fr. Sauter AG",
|
|
[81] = "Matsushita Electric Works Ltd.",
|
|
[82] = "Mitsubishi Electric Corporation Inazawa Works",
|
|
[83] = "Mitsubishi Heavy Industries Ltd.",
|
|
[84] = "ITT Bell & Gossett",
|
|
[85] = "Yamatake Building Systems Co. Ltd.",
|
|
[86] = "The Watt Stopper Inc.",
|
|
[87] = "Aichi Tokei Denki Co. Ltd.",
|
|
[88] = "Activation Technologies LLC",
|
|
[89] = "Saia-Burgess Controls Ltd.",
|
|
[90] = "Hitachi Ltd.",
|
|
[91] = "Novar Corp./Trend Control Systems Ltd.",
|
|
[92] = "Mitsubishi Electric Lighting Corporation",
|
|
[93] = "Argus Control Systems Ltd.",
|
|
[94] = "Kyuki Corporation",
|
|
[95] = "Richards-Zeta Building Intelligence Inc.",
|
|
[96] = "Scientech R&D Inc.",
|
|
[97] = "VCI Controls Inc.",
|
|
[98] = "Toshiba Corporation",
|
|
[99] = "Mitsubishi Electric Corporation Air Conditioning & Refrigeration Systems Works",
|
|
[100] = "Custom Mechanical Equipment LLC",
|
|
[101] = "ClimateMaster",
|
|
[102] = "ICP Panel-Tec Inc.",
|
|
[103] = "D-Tek Controls",
|
|
[104] = "NEC Engineering Ltd.",
|
|
[105] = "PRIVA BV",
|
|
[106] = "Meidensha Corporation",
|
|
[107] = "JCI Systems Integration Services",
|
|
[108] = "Freedom Corporation",
|
|
[109] = "Neuberger Gebäeautomation GmbH",
|
|
[110] = "Sitronix",
|
|
[111] = "Leviton Manufacturing",
|
|
[112] = "Fujitsu Limited",
|
|
[113] = "Emerson Network Power",
|
|
[114] = "S. A. Armstrong Ltd.",
|
|
[115] = "Visonet AG",
|
|
[116] = "M&M Systems Inc.",
|
|
[117] = "Custom Software Engineering",
|
|
[118] = "Nittan Company Limited",
|
|
[119] = "Elutions Inc. (Wizcon Systems SAS)",
|
|
[120] = "Pacom Systems Pty. Ltd.",
|
|
[121] = "Unico Inc.",
|
|
[122] = "Ebtron Inc.",
|
|
[123] = "Scada Engine",
|
|
[124] = "AC Technology Corporation",
|
|
[125] = "Eagle Technology",
|
|
[126] = "Data Aire Inc.",
|
|
[127] = "ABB Inc.",
|
|
[128] = "Transbit Sp. z o. o.",
|
|
[129] = "Toshiba Carrier Corporation",
|
|
[130] = "Shenzhen Junzhi Hi-Tech Co. Ltd.",
|
|
[131] = "Tokai Soft",
|
|
[132] = "Blue Ridge Technologies",
|
|
[133] = "Veris Industries",
|
|
[134] = "Centaurus Prime",
|
|
[135] = "Sand Network Systems",
|
|
[136] = "Regulvar Inc.",
|
|
[137] = "AFDtek Division of Fastek International Inc.",
|
|
[138] = "PowerCold Comfort Air Solutions Inc.",
|
|
[139] = "I Controls",
|
|
[140] = "Viconics Electronics Inc.",
|
|
[141] = "Yaskawa America Inc.",
|
|
[142] = "DEOS control systems GmbH",
|
|
[143] = "Digitale Mess- und Steuersysteme AG",
|
|
[144] = "Fujitsu General Limited",
|
|
[145] = "Project Engineering S.r.l.",
|
|
[146] = "Sanyo Electric Co. Ltd.",
|
|
[147] = "Integrated Information Systems Inc.",
|
|
[148] = "Temco Controls Ltd.",
|
|
[149] = "Airtek International Inc.",
|
|
[150] = "Advantech Corporation",
|
|
[151] = "Titan Products Ltd.",
|
|
[152] = "Regel Partners",
|
|
[153] = "National Environmental Product",
|
|
[154] = "Unitec Corporation",
|
|
[155] = "Kanden Engineering Company",
|
|
[156] = "Messner Gebäetechnik GmbH",
|
|
[157] = "Integrated.CH",
|
|
[158] = "Price Industries",
|
|
[159] = "SE-Elektronic GmbH",
|
|
[160] = "Rockwell Automation",
|
|
[161] = "Enflex Corp.",
|
|
[162] = "ASI Controls",
|
|
[163] = "SysMik GmbH Dresden",
|
|
[164] = "HSC Regelungstechnik GmbH",
|
|
[165] = "Smart Temp Australia Pty. Ltd.",
|
|
[166] = "Cooper Controls",
|
|
[167] = "Duksan Mecasys Co. Ltd.",
|
|
[168] = "Fuji IT Co. Ltd.",
|
|
[169] = "Vacon Plc",
|
|
[170] = "Leader Controls",
|
|
[171] = "Cylon Controls Ltd.",
|
|
[172] = "Compas",
|
|
[173] = "Mitsubishi Electric Building Techno-Service Co. Ltd.",
|
|
[174] = "Building Control Integrators",
|
|
[175] = "ITG Worldwide (M) Sdn Bhd",
|
|
[176] = "Lutron Electronics Co. Inc.",
|
|
[178] = "LOYTEC Electronics GmbH",
|
|
[179] = "ProLon",
|
|
[180] = "Mega Controls Limited",
|
|
[181] = "Micro Control Systems Inc.",
|
|
[182] = "Kiyon Inc.",
|
|
[183] = "Dust Networks",
|
|
[184] = "Advanced Building Automation Systems",
|
|
[185] = "Hermos AG",
|
|
[186] = "CEZIM",
|
|
[187] = "Softing",
|
|
[188] = "Lynxspring",
|
|
[189] = "Schneider Toshiba Inverter Europe",
|
|
[190] = "Danfoss Drives A/S",
|
|
[191] = "Eaton Corporation",
|
|
[192] = "Matyca S.A.",
|
|
[193] = "Botech AB",
|
|
[194] = "Noveo Inc.",
|
|
[195] = "AMEV",
|
|
[196] = "Yokogawa Electric Corporation",
|
|
[197] = "GFR Gesellschaft füelungstechnik",
|
|
[198] = "Exact Logic",
|
|
[199] = "Mass Electronics Pty Ltd dba Innotech Control Systems Australia",
|
|
[200] = "Kandenko Co. Ltd.",
|
|
[201] = "DTF Daten-Technik Fries",
|
|
[202] = "Klimasoft Ltd.",
|
|
[203] = "Toshiba Schneider Inverter Corporation",
|
|
[204] = "Control Applications Ltd.",
|
|
[205] = "KDT Systems Co. Ltd.",
|
|
[206] = "Onicon Incorporated",
|
|
[207] = "Automation Displays Inc.",
|
|
[208] = "Control Solutions Inc.",
|
|
[209] = "Remsdaq Limited",
|
|
[210] = "NTT Facilities Inc.",
|
|
[211] = "VIPA GmbH",
|
|
[212] = "TSC21 Association of Japan",
|
|
[213] = "Strato Automation",
|
|
[214] = "HRW Limited",
|
|
[215] = "Lighting Control & Design Inc.",
|
|
[216] = "Mercy Electronic and Electrical Industries",
|
|
[217] = "Samsung SDS Co.Ltd",
|
|
[218] = "Impact Facility Solutions Inc.",
|
|
[219] = "Aircuity",
|
|
[220] = "Control Techniques Ltd.",
|
|
[221] = "OpenGeneral Pty. Ltd.",
|
|
[222] = "WAGO Kontakttechnik GmbH & Co. KG",
|
|
[223] = "Cerus Industrial",
|
|
[224] = "Chloride Power Protection Company",
|
|
[225] = "Computrols Inc.",
|
|
[226] = "Phoenix Contact GmbH & Co. KG",
|
|
[227] = "Grundfos Management A/S",
|
|
[228] = "Ridder Drive Systems",
|
|
[229] = "Soft Device SDN BHD",
|
|
[230] = "Integrated Control Technology Limited",
|
|
[231] = "AIRxpert Systems Inc.",
|
|
[232] = "Microtrol Limited",
|
|
[233] = "Red Lion Controls",
|
|
[234] = "Digital Electronics Corporation",
|
|
[235] = "Ennovatis GmbH",
|
|
[236] = "Serotonin Software Technologies Inc.",
|
|
[237] = "LS Industrial Systems Co. Ltd.",
|
|
[238] = "Square D Company",
|
|
[239] = "S Squared Innovations Inc.",
|
|
[240] = "Aricent Ltd.",
|
|
[241] = "EtherMetrics LLC",
|
|
[242] = "Industrial Control Communications Inc.",
|
|
[243] = "Paragon Controls Inc.",
|
|
[244] = "A. O. Smith Corporation",
|
|
[245] = "Contemporary Control Systems Inc.",
|
|
[246] = "Intesis Software SL",
|
|
[247] = "Ingenieurgesellschaft N. Hartleb mbH",
|
|
[248] = "Heat-Timer Corporation",
|
|
[249] = "Ingrasys Technology Inc.",
|
|
[250] = "Costerm Building Automation",
|
|
[251] = "WILO SE",
|
|
[252] = "Embedia Technologies Corp.",
|
|
[253] = "Technilog",
|
|
[254] = "HR Controls Ltd. & Co. KG",
|
|
[255] = "Lennox International Inc.",
|
|
[256] = "RK-Tec Rauchklappen-Steuerungssysteme GmbH & Co. KG",
|
|
[257] = "Thermomax Ltd.",
|
|
[258] = "ELCON Electronic Control Ltd.",
|
|
[259] = "Larmia Control AB",
|
|
[260] = "BACnet Stack at SourceForge",
|
|
[261] = "G4S Security Services A/S",
|
|
[262] = "Exor International S.p.A.",
|
|
[263] = "Cristal Controles",
|
|
[264] = "Regin AB",
|
|
[265] = "Dimension Software Inc.",
|
|
[266] = "SynapSense Corporation",
|
|
[267] = "Beijing Nantree Electronic Co. Ltd.",
|
|
[268] = "Camus Hydronics Ltd.",
|
|
[269] = "Kawasaki Heavy Industries Ltd.",
|
|
[270] = "Critical Environment Technologies",
|
|
[271] = "ILSHIN IBS Co. Ltd.",
|
|
[272] = "ELESTA Energy Control AG",
|
|
[273] = "KROPMAN Installatietechniek",
|
|
[274] = "Baldor Electric Company",
|
|
[275] = "INGA mbH",
|
|
[276] = "GE Consumer & Industrial",
|
|
[277] = "Functional Devices Inc.",
|
|
[278] = "ESAC",
|
|
[279] = "M-System Co. Ltd.",
|
|
[280] = "Yokota Co. Ltd.",
|
|
[281] = "Hitranse Technology Co.LTD",
|
|
[282] = "Federspiel Controls",
|
|
[283] = "Kele Inc.",
|
|
[284] = "Opera Electronics Inc.",
|
|
[285] = "Gentec",
|
|
[286] = "Embedded Science Labs LLC",
|
|
[287] = "Parker Hannifin Corporation",
|
|
[288] = "MaCaPS International Limited",
|
|
[289] = "Link4 Corporation",
|
|
[290] = "Romutec Steuer-u. Regelsysteme GmbH",
|
|
[291] = "Pribusin Inc.",
|
|
[292] = "Advantage Controls",
|
|
[293] = "Critical Room Control",
|
|
[294] = "LEGRAND",
|
|
[295] = "Tongdy Control Technology Co. Ltd.",
|
|
[296] = "ISSARO Integrierte Systemtechnik",
|
|
[297] = "Pro-Dev Industries",
|
|
[298] = "DRI-STEEM",
|
|
[299] = "Creative Electronic GmbH",
|
|
[300] = "Swegon AB",
|
|
[301] = "Jan Brachacek",
|
|
[302] = "Hitachi Appliances Inc.",
|
|
[303] = "Real Time Automation Inc.",
|
|
[304] = "ITEC Hankyu-Hanshin Co.",
|
|
[305] = "Cyrus E&M Engineering Co. Ltd.",
|
|
[306] = "Racine Federated Inc.",
|
|
[307] = "Cirrascale Corporation",
|
|
[308] = "Elesta GmbH Building Automation",
|
|
[309] = "Securiton",
|
|
[310] = "OSlsoft Inc.",
|
|
[311] = "Hanazeder Electronic GmbH",
|
|
[312] = "Honeywell Security DeutschlandNovar GmbH",
|
|
[313] = "Siemens Energy & Automation Inc.",
|
|
[314] = "ETM Professional Control GmbH",
|
|
[315] = "Meitav-tec Ltd.",
|
|
[316] = "Janitza Electronics GmbH",
|
|
[317] = "MKS Nordhausen",
|
|
[318] = "De Gier Drive Systems B.V.",
|
|
[319] = "Cypress Envirosystems",
|
|
[320] = "SMARTron s.r.o.",
|
|
[321] = "Verari Systems Inc.",
|
|
[322] = "K-W Electronic Service Inc.",
|
|
[323] = "ALFA-SMART Energy Management",
|
|
[324] = "Telkonet Inc.",
|
|
[325] = "Securiton GmbH",
|
|
[326] = "Cemtrex Inc.",
|
|
[327] = "Performance Technologies Inc.",
|
|
[328] = "Xtralis (Aust) Pty Ltd",
|
|
[329] = "TROX GmbH",
|
|
[330] = "Beijing Hysine Technology Co.Ltd",
|
|
[331] = "RCK Controls Inc.",
|
|
[332] = "Distech Controls SAS",
|
|
[333] = "Novar/Honeywell",
|
|
[334] = "The S4 Group Inc.",
|
|
[335] = "Schneider Electric",
|
|
[336] = "LHA Systems",
|
|
[337] = "GHM engineering Group Inc.",
|
|
[338] = "Cllimalux S.A.",
|
|
[339] = "VAISALA Oyj",
|
|
[340] = "COMPLEX (Beijing) TechnologyCo. Ltd.",
|
|
[341] = "SCADAmetrics",
|
|
[342] = "POWERPEG NSI Limited",
|
|
[343] = "BACnet Interoperability Testing Services Inc.",
|
|
[344] = "Teco a.s.",
|
|
[345] = "Plexus Technology Inc.",
|
|
[346] = "Energy Focus Inc.",
|
|
[347] = "Powersmiths International Corp.",
|
|
[348] = "Nichibei Co. Ltd.",
|
|
[349] = "HKC Technology Ltd.",
|
|
[350] = "Ovation Networks Inc.",
|
|
[351] = "Setra Systems",
|
|
[352] = "AVG Automation",
|
|
[353] = "ZXC Ltd.",
|
|
[354] = "Byte Sphere",
|
|
[355] = "Generiton Co. Ltd.",
|
|
[356] = "Holter Regelarmaturen GmbH & Co. KG",
|
|
[357] = "Bedford Instruments LLC",
|
|
[358] = "Standair Inc.",
|
|
[359] = "WEG Automation - R&D",
|
|
[360] = "Prolon Control Systems ApS",
|
|
[361] = "Inneasoft",
|
|
[362] = "ConneXSoft GmbH",
|
|
[363] = "CEAG Notlichtsysteme GmbH",
|
|
[364] = "Distech Controls Inc.",
|
|
[365] = "Industrial Technology Research Institute",
|
|
[366] = "ICONICS Inc.",
|
|
[367] = "IQ Controls s.c.",
|
|
[368] = "OJ Electronics A/S",
|
|
[369] = "Rolbit Ltd.",
|
|
[370] = "Synapsys Solutions Ltd.",
|
|
[371] = "ACME Engineering Prod. Ltd.",
|
|
[372] = "Zener Electric Pty Ltd.",
|
|
[373] = "Selectronix Inc.",
|
|
[374] = "Gorbet & Banerjee LLC.",
|
|
[375] = "IME",
|
|
[376] = "Stephen H. Dawson Computer Service",
|
|
[377] = "Accutrol LLC",
|
|
[378] = "Schneider Elektronik GmbH",
|
|
[379] = "Alpha-Inno Tec GmbH",
|
|
[380] = "ADMMicro Inc.",
|
|
[381] = "Greystone Energy Systems Inc.",
|
|
[382] = "CAP Technologie",
|
|
[383] = "KeRo Systems",
|
|
[384] = "Domat Control System s.r.o.",
|
|
[385] = "Efektronics Pty. Ltd.",
|
|
[386] = "Hekatron Vertriebs GmbH",
|
|
[387] = "Securiton AG",
|
|
[388] = "Carlo Gavazzi Controls SpA",
|
|
[389] = "Chipkin Automation Systems",
|
|
[390] = "Savant Systems LLC",
|
|
[391] = "Simmtronic Lighting Controls",
|
|
[392] = "Abelko Innovation AB",
|
|
[393] = "Seresco Technologies Inc.",
|
|
[394] = "IT Watchdogs",
|
|
[395] = "Automation Assist Japan Corp.",
|
|
[396] = "Thermokon Sensortechnik GmbH",
|
|
[397] = "EGauge Systems LLC",
|
|
[398] = "Quantum Automation (ASIA) PTE Ltd.",
|
|
[399] = "Toshiba Lighting & Technology Corp.",
|
|
[400] = "SPIN Engenharia de Automaç Ltda.",
|
|
[401] = "Logistics Systems & Software Services India PVT. Ltd.",
|
|
[402] = "Delta Controls Integration Products",
|
|
[403] = "Focus Media",
|
|
[404] = "LUMEnergi Inc.",
|
|
[405] = "Kara Systems",
|
|
[406] = "RF Code Inc.",
|
|
[407] = "Fatek Automation Corp.",
|
|
[408] = "JANDA Software Company LLC",
|
|
[409] = "Open System Solutions Limited",
|
|
[410] = "Intelec Systems PTY Ltd.",
|
|
[411] = "Ecolodgix LLC",
|
|
[412] = "Douglas Lighting Controls",
|
|
[413] = "iSAtech GmbH",
|
|
[414] = "AREAL",
|
|
[415] = "Beckhoff Automation GmbH",
|
|
[416] = "IPAS GmbH",
|
|
[417] = "KE2 Therm Solutions",
|
|
[418] = "Base2Products",
|
|
[419] = "DTL Controls LLC",
|
|
[420] = "INNCOM International Inc.",
|
|
[421] = "BTR Netcom GmbH",
|
|
[422] = "Greentrol AutomationInc",
|
|
[423] = "BELIMO Automation AG",
|
|
[424] = "Samsung Heavy Industries CoLtd",
|
|
[425] = "Triacta Power Technologies Inc.",
|
|
[426] = "Globestar Systems",
|
|
[427] = "MLB Advanced MediaLP",
|
|
[428] = "SWG Stuckmann Wirtschaftliche Gebäesysteme GmbH",
|
|
[429] = "SensorSwitch",
|
|
[430] = "Multitek Power Limited",
|
|
[431] = "Aquametro AG",
|
|
[432] = "LG Electronics Inc.",
|
|
[433] = "Electronic Theatre Controls Inc.",
|
|
[434] = "Mitsubishi Electric Corporation Nagoya Works",
|
|
[435] = "Delta Electronics Inc.",
|
|
[436] = "Elma Kurtalj Ltd.",
|
|
[437] = "ADT Fire and Security Sp. A.o.o.",
|
|
[438] = "Nedap Security Management",
|
|
[439] = "ESC Automation Inc.",
|
|
[440] = "DSP4YOU Ltd.",
|
|
[441] = "GE Sensing and Inspection Technologies",
|
|
[442] = "Embedded Systems SIA",
|
|
[443] = "BEFEGA GmbH",
|
|
[444] = "Baseline Inc.",
|
|
[445] = "M2M Systems Integrators",
|
|
[446] = "OEMCtrl",
|
|
[447] = "Clarkson Controls Limited",
|
|
[448] = "Rogerwell Control System Limited",
|
|
[449] = "SCL Elements",
|
|
[450] = "Hitachi Ltd.",
|
|
[451] = "Newron System SA",
|
|
[452] = "BEVECO Gebouwautomatisering BV",
|
|
[453] = "Streamside Solutions",
|
|
[454] = "Yellowstone Soft",
|
|
[455] = "Oztech Intelligent Systems Pty Ltd.",
|
|
[456] = "Novelan GmbH",
|
|
[457] = "Flexim Americas Corporation",
|
|
[458] = "ICP DAS Co. Ltd.",
|
|
[459] = "CARMA Industries Inc.",
|
|
[460] = "Log-One Ltd.",
|
|
[461] = "TECO Electric & Machinery Co. Ltd.",
|
|
[462] = "ConnectEx Inc.",
|
|
[463] = "Turbo DDC Sü",
|
|
[464] = "Quatrosense Environmental Ltd.",
|
|
[465] = "Fifth Light Technology Ltd.",
|
|
[466] = "Scientific Solutions Ltd.",
|
|
[467] = "Controller Area Network Solutions (M) Sdn Bhd",
|
|
[468] = "RESOL - Elektronische Regelungen GmbH",
|
|
[469] = "RPBUS LLC",
|
|
[470] = "BRS Sistemas Eletronicos",
|
|
[471] = "WindowMaster A/S",
|
|
[472] = "Sunlux Technologies Ltd.",
|
|
[473] = "Measurlogic",
|
|
[474] = "Frimat GmbH",
|
|
[475] = "Spirax Sarco",
|
|
[476] = "Luxtron",
|
|
[477] = "Raypak Inc",
|
|
[478] = "Air Monitor Corporation",
|
|
[479] = "Regler Och Webbteknik Sverige (ROWS)",
|
|
[480] = "Intelligent Lighting Controls Inc.",
|
|
[481] = "Sanyo Electric Industry Co.Ltd",
|
|
[482] = "E-Mon Energy Monitoring Products",
|
|
[483] = "Digital Control Systems",
|
|
[484] = "ATI Airtest Technologies Inc.",
|
|
[485] = "SCS SA",
|
|
[486] = "HMS Industrial Networks AB",
|
|
[487] = "Shenzhen Universal Intellisys Co Ltd",
|
|
[488] = "EK Intellisys Sdn Bhd",
|
|
[489] = "SysCom",
|
|
[490] = "Firecom Inc.",
|
|
[491] = "ESA Elektroschaltanlagen Grimma GmbH",
|
|
[492] = "Kumahira Co Ltd",
|
|
[493] = "Hotraco",
|
|
[494] = "SABO Elektronik GmbH",
|
|
[495] = "Equip'Trans",
|
|
[496] = "TCS Basys Controls",
|
|
[497] = "FlowCon International A/S",
|
|
[498] = "ThyssenKrupp Elevator Americas",
|
|
[499] = "Abatement Technologies",
|
|
[500] = "Continental Control Systems LLC",
|
|
[501] = "WISAG Automatisierungstechnik GmbH & Co KG",
|
|
[502] = "EasyIO",
|
|
[503] = "EAP-Electric GmbH",
|
|
[504] = "Hardmeier",
|
|
[505] = "Mircom Group of Companies",
|
|
[506] = "Quest Controls",
|
|
[507] = "MestekInc",
|
|
[508] = "Pulse Energy",
|
|
[509] = "Tachikawa Corporation",
|
|
[510] = "University of Nebraska-Lincoln",
|
|
[511] = "Redwood Systems",
|
|
[512] = "PASStec Industrie-Elektronik GmbH",
|
|
[513] = "NgEK Inc.",
|
|
[514] = "FAW Electronics Ltd",
|
|
[515] = "Jireh Energy Tech Co. Ltd.",
|
|
[516] = "Enlighted Inc.",
|
|
[517] = "El-Piast Sp. Z o.o",
|
|
[518] = "NetxAutomation Software GmbH",
|
|
[519] = "Invertek Drives",
|
|
[520] = "Deutschmann Automation GmbH & Co. KG",
|
|
[521] = "EMU Electronic AG",
|
|
[522] = "Phaedrus Limited",
|
|
[523] = "Sigmatek GmbH & Co KG",
|
|
[524] = "Marlin Controls",
|
|
[525] = "CircutorSA",
|
|
[526] = "UTC Fire & Security",
|
|
[527] = "DENT Instruments Inc.",
|
|
[528] = "FHP Manufacturing Company - Bosch Group",
|
|
[529] = "GE Intelligent Platforms",
|
|
[530] = "Inner Range Pty Ltd",
|
|
[531] = "GLAS Energy Technology",
|
|
[532] = "MSR-Electronic-GmbH",
|
|
[533] = "Energy Control Systems Inc.",
|
|
[534] = "EMT Controls",
|
|
[535] = "Daintree Networks Inc.",
|
|
[536] = "EURO ICC d.o.o",
|
|
[537] = "TE Connectivity Energy",
|
|
[538] = "GEZE GmbH",
|
|
[539] = "NEC Corporation",
|
|
[540] = "Ho Cheung International Company Limited",
|
|
[541] = "Sharp Manufacturing Systems Corporation",
|
|
[542] = "DOT CONTROLS a.s.",
|
|
[543] = "BeaconMedæ0220",
|
|
[544] = "Midea Commercial Aircon",
|
|
[545] = "WattMaster Controls",
|
|
[546] = "Kamstrup A/S",
|
|
[547] = "CA Computer Automation GmbH",
|
|
[548] = "Laars Heating Systems Company",
|
|
[549] = "Hitachi Systems Ltd.",
|
|
[550] = "Fushan AKE Electronic Engineering Co. Ltd.",
|
|
[551] = "Toshiba International Corporation",
|
|
[552] = "Starman Systems LLC",
|
|
[553] = "Samsung Techwin Co. Ltd.",
|
|
[554] = "ISAS-Integrated Switchgear and Systems P/L",
|
|
[556] = "Obvius",
|
|
[557] = "Marek Guzik",
|
|
[558] = "Vortek Instruments LLC",
|
|
[559] = "Universal Lighting Technologies",
|
|
[560] = "Myers Power Products Inc.",
|
|
[561] = "Vector Controls GmbH",
|
|
[562] = "Crestron Electronics Inc.",
|
|
[563] = "A&E Controls Limited",
|
|
[564] = "Projektomontaza A.D.",
|
|
[565] = "Freeaire Refrigeration",
|
|
[566] = "Aqua Cooler Pty Limited",
|
|
[567] = "Basic Controls",
|
|
[568] = "GE Measurement and Control Solutions Advanced Sensors",
|
|
[569] = "EQUAL Networks",
|
|
[570] = "Millennial Net",
|
|
[571] = "APLI Ltd",
|
|
[572] = "Electro Industries/GaugeTech",
|
|
[573] = "SangMyung University",
|
|
[574] = "Coppertree Analytics Inc.",
|
|
[575] = "CoreNetiX GmbH",
|
|
[576] = "Acutherm",
|
|
[577] = "Dr. Riedel Automatisierungstechnik GmbH",
|
|
[578] = "Shina System Co.Ltd",
|
|
[579] = "Iqapertus",
|
|
[580] = "PSE Technology",
|
|
[581] = "BA Systems",
|
|
[582] = "BTICINO",
|
|
[583] = "Monico Inc.",
|
|
[584] = "iCue",
|
|
[585] = "tekmar Control Systems Ltd.",
|
|
[586] = "Control Technology Corporation",
|
|
[587] = "GFAE GmbH",
|
|
[588] = "BeKa Software GmbH",
|
|
[589] = "Isoil Industria SpA",
|
|
[590] = "Home Systems Consulting SpA",
|
|
[591] = "Socomec",
|
|
[592] = "Everex Communications Inc.",
|
|
[593] = "Ceiec Electric Technology",
|
|
[594] = "Atrila GmbH",
|
|
[595] = "WingTechs",
|
|
[596] = "Shenzhen Mek Intellisys Pte Ltd.",
|
|
[597] = "Nestfield Co. Ltd.",
|
|
[598] = "Swissphone Telecom AG",
|
|
[599] = "PNTECH JSC",
|
|
[600] = "Horner APG LLC",
|
|
[601] = "PVI Industries LLC",
|
|
[602] = "Ela-compil",
|
|
[603] = "Pegasus Automation International LLC",
|
|
[604] = "Wight Electronic Services Ltd.",
|
|
[605] = "Marcom",
|
|
[606] = "Exhausto A/S",
|
|
[607] = "Dwyer Instruments Inc.",
|
|
[608] = "Link GmbH",
|
|
[609] = "Oppermann Regelgerate GmbH",
|
|
[610] = "NuAire Inc.",
|
|
[611] = "Nortec Humidity Inc.",
|
|
[612] = "Bigwood Systems Inc.",
|
|
[613] = "Enbala Power Networks",
|
|
[614] = "Inter Energy Co. Ltd.",
|
|
[615] = "ETC",
|
|
[616] = "COMELEC S.A.R.L",
|
|
[617] = "Pythia Technologies",
|
|
[618] = "TrendPoint Systems Inc.",
|
|
[619] = "AWEX",
|
|
[620] = "Eurevia",
|
|
[621] = "Kongsberg E-lon AS",
|
|
[622] = "FlaktWoods",
|
|
[623] = "E + E Elektronik GES M.B.H.",
|
|
[624] = "ARC Informatique",
|
|
[625] = "SKIDATA AG",
|
|
[626] = "WSW Solutions",
|
|
[627] = "Trefon Electronic GmbH",
|
|
[628] = "Dongseo System",
|
|
[629] = "Kanontec Intelligence Technology Co. Ltd.",
|
|
[630] = "EVCO S.p.A.",
|
|
[631] = "Accuenergy (CANADA) Inc.",
|
|
[632] = "SoftDEL",
|
|
[633] = "Orion Energy Systems Inc.",
|
|
[634] = "Roboticsware",
|
|
[635] = "DOMIQ Sp. z o.o.",
|
|
[636] = "Solidyne",
|
|
[637] = "Elecsys Corporation",
|
|
[638] = "Conditionaire International Pty. Limited",
|
|
[639] = "Quebec Inc.",
|
|
[640] = "Homerun Holdings",
|
|
[641] = "RFM Inc.",
|
|
[642] = "Comptek",
|
|
[643] = "Westco Systems Inc.",
|
|
[644] = "Advancis Software & Services GmbH",
|
|
[645] = "Intergrid LLC",
|
|
[646] = "Markerr Controls Inc.",
|
|
[647] = "Toshiba Elevator and Building Systems Corporation",
|
|
[648] = "Spectrum Controls Inc.",
|
|
[649] = "Mkservice",
|
|
[650] = "Fox Thermal Instruments",
|
|
[651] = "SyxthSense Ltd",
|
|
[652] = "DUHA System S R.O.",
|
|
[653] = "NIBE",
|
|
[654] = "Melink Corporation",
|
|
[655] = "Fritz-Haber-Institut",
|
|
[656] = "MTU Onsite Energy GmbHGas Power Systems",
|
|
[657] = "Omega Engineering Inc.",
|
|
[658] = "Avelon",
|
|
[659] = "Ywire Technologies Inc.",
|
|
[660] = "M.R. Engineering Co. Ltd.",
|
|
[661] = "Lochinvar LLC",
|
|
[662] = "Sontay Limited",
|
|
[663] = "GRUPA Slawomir Chelminski",
|
|
[664] = "Arch Meter Corporation",
|
|
[665] = "Senva Inc.",
|
|
[667] = "FM-Tec",
|
|
[668] = "Systems Specialists Inc.",
|
|
[669] = "SenseAir",
|
|
[670] = "AB IndustrieTechnik Srl",
|
|
[671] = "Cortland Research LLC",
|
|
[672] = "MediaView",
|
|
[673] = "VDA Elettronica",
|
|
[674] = "CSS Inc.",
|
|
[675] = "Tek-Air Systems Inc.",
|
|
[676] = "ICDT",
|
|
[677] = "The Armstrong Monitoring Corporation",
|
|
[678] = "DIXELL S.r.l",
|
|
[679] = "Lead System Inc.",
|
|
[680] = "ISM EuroCenter S.A.",
|
|
[681] = "TDIS",
|
|
[682] = "Trade FIDES",
|
|
[683] = "KnübH (Emerson Network Power)",
|
|
[684] = "Resource Data Management",
|
|
[685] = "Abies Technology Inc.",
|
|
[686] = "Amalva",
|
|
[687] = "MIRAE Electrical Mfg. Co. Ltd.",
|
|
[688] = "HunterDouglas Architectural Projects Scandinavia ApS",
|
|
[689] = "RUNPAQ Group Co.Ltd",
|
|
[690] = "Unicard SA",
|
|
[691] = "IE Technologies",
|
|
[692] = "Ruskin Manufacturing",
|
|
[693] = "Calon Associates Limited",
|
|
[694] = "Contec Co. Ltd.",
|
|
[695] = "iT GmbH",
|
|
[696] = "Autani Corporation",
|
|
[697] = "Christian Fortin",
|
|
[698] = "HDL",
|
|
[699] = "IPID Sp. Z.O.O Limited",
|
|
[700] = "Fuji Electric Co.Ltd",
|
|
[701] = "View Inc.",
|
|
[702] = "Samsung S1 Corporation",
|
|
[703] = "New Lift",
|
|
[704] = "VRT Systems",
|
|
[705] = "Motion Control Engineering Inc.",
|
|
[706] = "Weiss Klimatechnik GmbH",
|
|
[707] = "Elkon",
|
|
[708] = "Eliwell Controls S.r.l.",
|
|
[709] = "Japan Computer Technos Corp",
|
|
[710] = "Rational Network ehf",
|
|
[711] = "Magnum Energy Solutions LLC",
|
|
[712] = "MelRok",
|
|
[713] = "VAE Group",
|
|
[714] = "LGCNS",
|
|
[715] = "Berghof Automationstechnik GmbH",
|
|
[716] = "Quark Communications Inc.",
|
|
[717] = "Sontex",
|
|
[718] = "mivune AG",
|
|
[719] = "Panduit",
|
|
[720] = "Smart Controls LLC",
|
|
[721] = "Compu-Aire Inc.",
|
|
[722] = "Sierra",
|
|
[723] = "ProtoSense Technologies",
|
|
[724] = "Eltrac Technologies Pvt Ltd",
|
|
[725] = "Bektas Invisible Controls GmbH",
|
|
[726] = "Entelec",
|
|
[727] = "Innexiv",
|
|
[728] = "Covenant",
|
|
[729] = "Davitor AB",
|
|
[730] = "TongFang Technovator",
|
|
[731] = "Building Robotics",
|
|
[732] = "HSS-MSR UG",
|
|
[733] = "FramTack LLC",
|
|
[734] = "B. L. Acoustics",
|
|
[735] = "Traxxon Rock Drills",
|
|
[736] = "Franke",
|
|
[737] = "Wurm GmbH & Co",
|
|
[738] = "AddENERGIE",
|
|
[739] = "Mirle Automation Corporation",
|
|
[740] = "Ibis Networks",
|
|
[741] = "ID-KARTA s.r.o.",
|
|
[742] = "Anaren",
|
|
[743] = "Span",
|
|
[744] = "Bosch Thermotechnology Corp",
|
|
[745] = "DRC Technology S.A.",
|
|
[746] = "Shanghai Energy Building Technology Co",
|
|
[747] = "Fraport AG",
|
|
[748] = "Flowgroup",
|
|
[749] = "Skytron Energy",
|
|
[750] = "ALTEL Wicha",
|
|
[751] = "Drupal",
|
|
[752] = "Axiomatic Technology",
|
|
[753] = "Bohnke + Partner",
|
|
[754] = "Function 1",
|
|
[755] = "Optergy Pty",
|
|
[756] = "LSI Virticus",
|
|
[757] = "Konzeptpark GmbH",
|
|
[758] = "Hubbell Building Automation",
|
|
[759] = "eCurv",
|
|
[760] = "Agnosys GmbH",
|
|
[761] = "Shanghai Sunfull Automation Co.",
|
|
[762] = "Kurz Instruments",
|
|
[763] = "Cias Elettronica S.r.l.",
|
|
[764] = "Multiaqua",
|
|
[765] = "BlueBox",
|
|
[766] = "Sensidyne",
|
|
[767] = "Viessmann Elektronik GmbH",
|
|
[768] = "ADFweb.com srl",
|
|
[769] = "Gaylord Industries",
|
|
[770] = "Majur Ltd.",
|
|
[771] = "Shanghai Huilin Technology Co.",
|
|
[772] = "Exotronic",
|
|
[773] = "Safecontrol spol s.r.o.",
|
|
[774] = "Amatis",
|
|
[775] = "Universal Electric Corporation",
|
|
[776] = "iBACnet",
|
|
[778] = "Smartrise Engineering",
|
|
[779] = "Miratron",
|
|
[780] = "SmartEdge",
|
|
[781] = "Mitsubishi Electric Australia Pty Ltd",
|
|
[782] = "Triangle Research International Ptd Ltd",
|
|
[783] = "Produal Oy",
|
|
[784] = "Milestone Systems A/S",
|
|
[785] = "Trustbridge",
|
|
[786] = "Feedback Solutions",
|
|
[787] = "IES",
|
|
[788] = "GE Critical Power",
|
|
[789] = "Riptide IO",
|
|
[790] = "Messerschmitt Systems AG",
|
|
[791] = "Dezem Energy Controlling",
|
|
[792] = "MechoSystems",
|
|
[793] = "evon GmbH",
|
|
[794] = "CS Lab GmbH",
|
|
[795] = "8760 Enterprises",
|
|
[796] = "Touche Controls",
|
|
[797] = "Ontrol Teknik Malzeme San. ve Tic. A.S.",
|
|
[798] = "Uni Control System Sp. Z o.o.",
|
|
[799] = "Weihai Ploumeter Co.",
|
|
[800] = "Elcom International Pvt. Ltd",
|
|
[801] = "Philips Lighting",
|
|
[802] = "AutomationDirect",
|
|
[803] = "Paragon Robotics",
|
|
[804] = "SMT System & Modules Technology AG",
|
|
[805] = "OS Technology Service and Trading Co.",
|
|
[806] = "CMR Controls Ltd",
|
|
[807] = "Innovari",
|
|
[808] = "ABB Control Products",
|
|
[809] = "Gesellschaft fur Gebaudeautomation mbH",
|
|
[810] = "RODI Systems Corp.",
|
|
[811] = "Nextek Power Systems",
|
|
[812] = "Creative Lighting",
|
|
[813] = "WaterFurnace International",
|
|
[814] = "Mercury Security",
|
|
[815] = "Hisense (Shandong) Air-Conditioning Co.",
|
|
[816] = "Layered Solutions",
|
|
[817] = "Leegood Automatic System",
|
|
[818] = "Shanghai Restar Technology Co.",
|
|
[819] = "Reimann Ingenieurburo",
|
|
[820] = "LynTec",
|
|
[821] = "HTP",
|
|
[822] = "Elkor Technologies",
|
|
[823] = "Bentrol Pty Ltd",
|
|
[824] = "Team-Control Oy",
|
|
[825] = "NextDevice",
|
|
[826] = "GLOBAL CONTROL 5 Sp. z o.o.",
|
|
[827] = "King I Electronics Co.",
|
|
[828] = "SAMDAV",
|
|
[829] = "Next Gen Industries Pvt. Ltd.",
|
|
[830] = "Entic LLC",
|
|
[831] = "ETAP",
|
|
[832] = "Moralle Electronics Limited",
|
|
[833] = "Leicom AG",
|
|
[834] = "Watts Regulator Company",
|
|
[835] = "S.C. Orbtronics S.R.L.",
|
|
[836] = "Gaussan Technologies",
|
|
[837] = "WEBfactory GmbH",
|
|
[838] = "Ocean Controls",
|
|
[839] = "Messana Air-Ray Conditioning s.r.l.",
|
|
[840] = "Hangzhou BATOWN Technology Co. Ltd.",
|
|
[841] = "Reasonable Controls",
|
|
[842] = "Servisys",
|
|
[843] = "halstrup-walcher GmbH",
|
|
[844] = "SWG Automation Fuzhou Limited",
|
|
[845] = "KSB Aktiengesellschaft",
|
|
[846] = "Hybryd Sp. z o.o.",
|
|
[847] = "Helvatron AG",
|
|
[848] = "Oderon Sp. Z.O.O.",
|
|
[849] = "miko",
|
|
[850] = "Exodraft",
|
|
[851] = "Hochhuth GmbH",
|
|
[852] = "Integrated System Technologies Ltd.",
|
|
[853] = "Shanghai Cellcons Controls Co., Ltd",
|
|
[854] = "Emme Controls, LLC",
|
|
[855] = "Field Diagnostic Services, Inc.",
|
|
[856] = "Ges Teknik A.S.",
|
|
[857] = "Global Power Products, Inc.",
|
|
[858] = "Option NV",
|
|
[859] = "BV-Control AG",
|
|
[860] = "Sigren Engineering AG",
|
|
[861] = "Shanghai Jaltone Technology Co., Ltd.",
|
|
[862] = "MaxLine Solutions Ltd",
|
|
[863] = "Kron Instrumentos Elétricos Ltda",
|
|
[864] = "Thermo Matrix",
|
|
[865] = "Infinite Automation Systems, Inc.",
|
|
[866] = "Vantage",
|
|
[867] = "Elecon Measurements Pvt Ltd",
|
|
[868] = "TBA",
|
|
[869] = "Carnes Company",
|
|
[870] = "Harman Professional",
|
|
[871] = "Nenutec Asia Pacific Pte Ltd",
|
|
[872] = "Gia NV",
|
|
[873] = "Kepware Tehnologies",
|
|
[874] = "Temperature Electronics Ltd",
|
|
[875] = "Packet Power",
|
|
[876] = "Project Haystack Corporation",
|
|
[877] = "DEOS Controls Americas Inc.",
|
|
[878] = "Senseware Inc",
|
|
[879] = "MST Systemtechnik AG",
|
|
[880] = "Lonix Ltd",
|
|
[881] = "GMC-I Messtechnik GmbH",
|
|
[882] = "Aviosys International Inc.",
|
|
[883] = "Efficient Building Automation Corp.",
|
|
[884] = "Accutron Instruments Inc.",
|
|
[885] = "Vermont Energy Control Systems LLC",
|
|
[886] = "DCC Dynamics",
|
|
[887] = "B.E.G. Brück Electronic GmbH",
|
|
[889] = "NGBS Hungary Ltd.",
|
|
[890] = "ILLUM Technology, LLC",
|
|
[891] = "Delta Controls Germany Limited",
|
|
[892] = "S+T Service & Technique S.A.",
|
|
[893] = "SimpleSoft",
|
|
[894] = "Altair Engineering",
|
|
[895] = "EZEN Solution Inc.",
|
|
[896] = "Fujitec Co. Ltd.",
|
|
[897] = "Terralux",
|
|
[898] = "Annicom",
|
|
[899] = "Bihl+Wiedemann GmbH",
|
|
[900] = "Draper, Inc.",
|
|
[901] = "Schüco International KG",
|
|
[902] = "Otis Elevator Company",
|
|
[903] = "Fidelix Oy",
|
|
[904] = "RAM GmbH Mess- und Regeltechnik",
|
|
[905] = "WEMS",
|
|
[906] = "Ravel Electronics Pvt Ltd",
|
|
[907] = "OmniMagni",
|
|
[908] = "Echelon",
|
|
[909] = "Intellimeter Canada, Inc.",
|
|
[910] = "Bithouse Oy",
|
|
[912] = "BuildPulse",
|
|
[913] = "Shenzhen 1000 Building Automation Co. Ltd",
|
|
[914] = "AED Engineering GmbH",
|
|
[915] = "Güntner GmbH & Co. KG",
|
|
[916] = "KNXlogic",
|
|
[917] = "CIM Environmental Group",
|
|
[918] = "Flow Control",
|
|
[919] = "Lumen Cache, Inc.",
|
|
[920] = "Ecosystem",
|
|
[921] = "Potter Electric Signal Company, LLC",
|
|
[922] = "Tyco Fire & Security S.p.A.",
|
|
[923] = "Watanabe Electric Industry Co., Ltd.",
|
|
[924] = "Causam Energy",
|
|
[925] = "W-tec AG",
|
|
[926] = "IMI Hydronic Engineering International SA",
|
|
[927] = "ARIGO Software",
|
|
[928] = "MSA Safety",
|
|
[929] = "Smart Solucoes Ltda - MERCATO",
|
|
[930] = "PIATRA Engineering",
|
|
[931] = "ODIN Automation Systems, LLC",
|
|
[932] = "Belparts NV",
|
|
[933] = "UAB, SALDA",
|
|
[934] = "Alre-IT Regeltechnik GmbH",
|
|
[935] = "Ingenieurbüro H. Lertes GmbH & Co. KG",
|
|
[936] = "Breathing Buildings",
|
|
[937] = "eWON SA",
|
|
[938] = "Cav. Uff. Giacomo Cimberio S.p.A",
|
|
[939] = "PKE Electronics AG",
|
|
[940] = "Allen",
|
|
[941] = "Kastle Systems",
|
|
[942] = "Logical Electro-Mechanical (EM) Systems, Inc.",
|
|
[943] = "ppKinetics Instruments, LLC",
|
|
[944] = "Cathexis Technologies",
|
|
[945] = "Sylop sp. Z o.o. sp.k",
|
|
[946] = "Brauns Control GmbH",
|
|
[947] = "Omron Corporation",
|
|
[948] = "Wildeboer Bauteile Gmbh",
|
|
[949] = "Shanghai Biens Technologies Ltd",
|
|
[950] = "Beijing HZHY Technology Co., Ltd",
|
|
[951] = "Building Clouds",
|
|
[952] = "The University of Sheffield-Department of Electronic and Electrical Engineering",
|
|
[953] = "Fabtronics Australia Pty Ltd",
|
|
[954] = "SLAT",
|
|
[955] = "Software Motor Corporation",
|
|
[956] = "Armstrong International Inc.",
|
|
[957] = "Steril-Aire, Inc.",
|
|
[958] = "Infinique",
|
|
[959] = "Arcom",
|
|
[960] = "Argo Performance, Ltd",
|
|
[961] = "Dialight",
|
|
[962] = "Ideal Technical Solutions",
|
|
[963] = "Neurobat AG",
|
|
[964] = "Neyer Software Consulting LLC",
|
|
[965] = "SCADA Technology Development Co., Ltd.",
|
|
[966] = "Demand Logic Limited",
|
|
[967] = "GWA Group Limited",
|
|
[968] = "Occitaline",
|
|
[969] = "NAO Digital Co., Ltd.",
|
|
[970] = "Shenzhen Chanslink Network Technology Co., Ltd.",
|
|
[971] = "Samsung Electronics Co., Ltd.",
|
|
[972] = "Mesa Laboratories, Inc.",
|
|
[973] = "Fischer",
|
|
[974] = "OpSys Solutions Ltd.",
|
|
[975] = "Advanced Devices Limited",
|
|
[976] = "Condair",
|
|
[977] = "INELCOM Ingenieria Electronica Comercial S.A.",
|
|
[978] = "GridPoint, Inc.",
|
|
[979] = "ADF Technologies Sdn Bhd",
|
|
[980] = "EPM, Inc.",
|
|
[981] = "Lighting Controls Ltd",
|
|
[982] = "Perix Controls Ltd.",
|
|
[983] = "AERCO International, Inc.",
|
|
[984] = "KONE Inc.",
|
|
[985] = "Ziehl-Abegg SE",
|
|
[986] = "Robot, S.A.",
|
|
[987] = "Optigo Networks, Inc.",
|
|
[988] = "Openmotics BVBA",
|
|
[989] = "Metropolitan Industries, Inc.",
|
|
[990] = "Huawei Technologies Co., Ltd.",
|
|
[991] = "OSRAM Sylvania, Inc.",
|
|
[992] = "Vanti",
|
|
[993] = "Cree Lighting",
|
|
[994] = "Richmond Heights SDN BHD",
|
|
[995] = "Payne-Sparkman Lighting Mangement",
|
|
[996] = "Ashcroft",
|
|
[997] = "Jet Controls Corp",
|
|
[998] = "Zumtobel Lighting GmbH",
|
|
[1000] = "Ekon GmbH",
|
|
[1001] = "Molex",
|
|
[1002] = "Maco Lighting Pty Ltd.",
|
|
[1003] = "Axecon Corp.",
|
|
[1004] = "Tensor plc",
|
|
[1005] = "Kaseman Environmental Control Equipment (Shanghai) Limited",
|
|
[1006] = "AB Axis Industries",
|
|
[1007] = "Netix Controls",
|
|
[1008] = "Eldridge Products, Inc.",
|
|
[1009] = "Micronics",
|
|
[1010] = "Fortecho Solutions Ltd",
|
|
[1011] = "Sellers Manufacturing Company",
|
|
[1012] = "Rite-Hite Doors, Inc.",
|
|
[1013] = "Violet Defense LLC",
|
|
[1014] = "Simna",
|
|
[1015] = "Multi-Énergie Best Inc.",
|
|
[1016] = "Mega System Technologies, Inc.",
|
|
[1017] = "Rheem",
|
|
[1018] = "Ing. Punzenberger COPA-DATA GmbH",
|
|
[1019] = "MEC Electronics GmbH",
|
|
[1020] = "Taco Comfort Solutions",
|
|
[1021] = "Alexander Maier GmbH",
|
|
[1022] = "Ecorithm, Inc.",
|
|
[1023] = "Accurro Ltd",
|
|
[1024] = "ROMTECK Australia Pty Ltd",
|
|
[1025] = "Splash Monitoring Limited",
|
|
[1026] = "Light Application",
|
|
[1027] = "Logical Building Automation",
|
|
[1028] = "Exilight Oy",
|
|
[1029] = "Hager Electro SAS",
|
|
[1030] = "KLIF Co., LTD",
|
|
[1031] = "HygroMatik",
|
|
[1032] = "Daniel Mousseau Programmation & Electronique",
|
|
[1033] = "Aerionics Inc.",
|
|
[1034] = "M2S Electronique Ltee",
|
|
[1035] = "Automation Components, Inc.",
|
|
[1036] = "Niobrara Research & Development Corporation",
|
|
[1037] = "Netcom Sicherheitstechnik GmbH",
|
|
[1038] = "Lumel S.A.",
|
|
[1039] = "Great Plains Industries, Inc.",
|
|
[1040] = "Domotica Labs S.R.L",
|
|
[1041] = "Energy Cloud, Inc.",
|
|
[1042] = "Vomatec",
|
|
[1043] = "Demma Companies",
|
|
[1044] = "Valsena",
|
|
[1045] = "Comsys Bärtsch AG",
|
|
[1046] = "bGrid",
|
|
[1047] = "MDJ Software Pty Ltd",
|
|
[1048] = "Dimonoff, Inc.",
|
|
[1049] = "Edomo Systems, GmbH",
|
|
[1050] = "Effektiv, LLC",
|
|
[1051] = "SteamOVap",
|
|
[1052] = "grandcentrix GmbH",
|
|
[1053] = "Weintek Labs, Inc.",
|
|
[1054] = "Intefox GmbH",
|
|
[1055] = "Radius22 Automation Company",
|
|
[1056] = "Ringdale, Inc.",
|
|
[1057] = "Iwaki America",
|
|
[1058] = "Bractlet",
|
|
[1059] = "STULZ Air Technology Systems, Inc.",
|
|
[1060] = "Climate Ready Engineering Pty Ltd",
|
|
[1061] = "Genea Energy Partners",
|
|
[1062] = "IoTall Chile",
|
|
[1063] = "IKS Co., Ltd.",
|
|
[1064] = "Yodiwo AB",
|
|
[1065] = "TITAN electronic GmbH",
|
|
[1066] = "IDEC Corporation",
|
|
[1067] = "SIFRI SL",
|
|
[1068] = "Thermal Gas Systems Inc.",
|
|
[1069] = "Building Automation Products, Inc.",
|
|
[1070] = "Asset Mapping",
|
|
[1071] = "Smarteh Company",
|
|
[1072] = "Datapod Australia Pty Ltd.",
|
|
[1073] = "Buildings Alive Pty Ltd",
|
|
[1074] = "Digital Elektronik",
|
|
[1075] = "Talent Automação e Tecnologia Ltda",
|
|
[1076] = "Norposh Limited",
|
|
[1077] = "Merkur Funksysteme AG",
|
|
[1078] = "Faster CZ spol. S.r.o",
|
|
[1079] = "Eco-Adapt",
|
|
[1080] = "Energocentrum Plus, s.r.o",
|
|
[1081] = "amBX UK Ltd",
|
|
[1082] = "Western Reserve Controls, Inc.",
|
|
[1083] = "LayerZero Power Systems, Inc.",
|
|
[1084] = "CIC Jan Hřebec s.r.o.",
|
|
[1085] = "Sigrov BV",
|
|
[1086] = "ISYS-Intelligent Systems",
|
|
[1087] = "Gas Detection (Australia) Pty Ltd",
|
|
[1088] = "Kinco Automation (Shanghai) Ltd.",
|
|
[1089] = "Lars Energy, LLC",
|
|
[1090] = "Flamefast (UK) Ltd.",
|
|
[1091] = "Royal Service Air Conditioning",
|
|
[1092] = "Ampio Sp. Z o.o.",
|
|
[1093] = "Inovonics Wireless Corporation",
|
|
[1094] = "Nvent Thermal Management",
|
|
[1095] = "Sinowell Control System Ltd",
|
|
[1096] = "Moxa Inc.",
|
|
[1097] = "Matrix iControl SDN BHD",
|
|
[1098] = "PurpleSwift",
|
|
[1099] = "OTIM Technologies",
|
|
[1100] = "FlowMate Limited",
|
|
[1101] = "Degree Controls, Inc.",
|
|
[1102] = "Fei Xing (Shanghai) Software Technologies Co., Ltd.",
|
|
[1103] = "Berg GmbH",
|
|
[1104] = "ARENZ.IT",
|
|
[1105] = "Edelstrom Electronic Devices & Designing LLC",
|
|
[1106] = "Drive Connect, LLC",
|
|
[1107] = "DevelopNow",
|
|
[1108] = "Poort",
|
|
[1109] = "VMEIL Information (Shanghai) Ltd",
|
|
[1110] = "Rayleigh Instruments",
|
|
[1112] = "CODESYS Development",
|
|
[1113] = "Smartware Technologies Group, LLC",
|
|
[1114] = "Polar Bear Solutions",
|
|
[1115] = "Codra",
|
|
[1116] = "Pharos Architectural Controls Ltd",
|
|
[1117] = "EngiNear Ltd.",
|
|
[1118] = "Ad Hoc Electronics",
|
|
[1119] = "Unified Microsystems",
|
|
[1120] = "Industrieelektronik Brandenburg GmbH",
|
|
[1121] = "Hartmann GmbH",
|
|
[1122] = "Piscada",
|
|
[1123] = "KMB systems, s.r.o.",
|
|
[1124] = "PowerTech Engineering AS",
|
|
[1125] = "Telefonbau Arthur Schwabe GmbH & Co. KG",
|
|
[1126] = "Wuxi Fistwelove Technology Co., Ltd.",
|
|
[1127] = "Prysm",
|
|
[1128] = "STEINEL GmbH",
|
|
[1129] = "Georg Fischer JRG AG",
|
|
[1130] = "Make Develop SL",
|
|
[1131] = "Monnit Corporation",
|
|
[1132] = "Mirror Life Corporation",
|
|
[1133] = "Secure Meters Limited",
|
|
[1134] = "PECO",
|
|
[1135] = ".CCTECH, Inc.",
|
|
[1136] = "LightFi Limited",
|
|
[1137] = "Nice Spa",
|
|
[1138] = "Fiber SenSys, Inc.",
|
|
[1139] = "B&D Buchta und Degeorgi",
|
|
[1140] = "Ventacity Systems, Inc.",
|
|
[1141] = "Hitachi-Johnson Controls Air Conditioning, Inc.",
|
|
[1142] = "Sage Metering, Inc.",
|
|
[1143] = "Andel Limited",
|
|
[1144] = "ECOSmart Technologies",
|
|
[1145] = "S.E.T.",
|
|
[1146] = "Protec Fire Detection Spain SL",
|
|
[1147] = "AGRAMER UG",
|
|
[1148] = "Anylink Electronic GmbH",
|
|
[1149] = "Schindler, Ltd",
|
|
[1150] = "Jibreel Abdeen Est.",
|
|
[1151] = "Fluidyne Control Systems Pvt. Ltd",
|
|
[1152] = "Prism Systems, Inc.",
|
|
[1153] = "Enertiv",
|
|
[1154] = "Mirasoft GmbH & Co. KG",
|
|
[1155] = "DUALTECH IT",
|
|
[1156] = "Countlogic, LLC",
|
|
[1157] = "Kohler",
|
|
[1158] = "Chen Sen Controls Co., Ltd.",
|
|
[1159] = "Greenheck",
|
|
[1160] = "Intwine Connect, LLC",
|
|
[1161] = "Karlborgs Elkontroll",
|
|
[1162] = "Datakom",
|
|
[1163] = "Hoga Control AS",
|
|
[1164] = "Cool Automation",
|
|
[1165] = "Inter Search Co., Ltd",
|
|
[1166] = "DABBEL-Automation Intelligence GmbH",
|
|
[1167] = "Gadgeon Engineering Smartness",
|
|
[1168] = "Coster Group S.r.l.",
|
|
[1169] = "Walter Müller AG",
|
|
[1170] = "Fluke",
|
|
[1171] = "Quintex Systems Ltd",
|
|
[1172] = "Senfficient SDN BHD",
|
|
[1173] = "Nube iO Operations Pty Ltd",
|
|
[1174] = "DAS Integrator Pte Ltd",
|
|
[1175] = "CREVIS Co., Ltd",
|
|
[1176] = "iSquared software inc.",
|
|
[1177] = "KTG GmbH",
|
|
[1178] = "POK Group Oy",
|
|
[1179] = "Adiscom",
|
|
[1180] = "Incusense",
|
|
[1181] = "75F",
|
|
[1182] = "Anord Mardix, Inc.",
|
|
[1183] = "HOSCH Gebäudeautomation Neue Produkte GmbH",
|
|
[1184] = "BOSCH Software Innovations GmbH",
|
|
[1185] = "Royal Boon Edam International B.V.",
|
|
[1186] = "Clack Corporation",
|
|
[1187] = "Unitex Controls LLC",
|
|
[1188] = "KTC Göteborg AB",
|
|
[1189] = "Interzon AB",
|
|
[1190] = "ISDE ING SL",
|
|
[1191] = "ABM automation building messaging GmbH",
|
|
[1192] = "Kentec Electronics Ltd",
|
|
[1193] = "Emerson Commercial and Residential Solutions",
|
|
[1194] = "Powerside",
|
|
[1195] = "SMC Group",
|
|
[1196] = "EOS Weather Instruments",
|
|
[1197] = "Zonex Systems",
|
|
[1198] = "Generex Systems Computervertriebsgesellschaft mbH",
|
|
[1199] = "Energy Wall LLC",
|
|
[1200] = "Thermofin",
|
|
[1201] = "SDATAWAY SA",
|
|
[1202] = "Biddle Air Systems Limited",
|
|
[1203] = "Kessler Ellis Products",
|
|
[1204] = "Thermoscreens",
|
|
[1205] = "Modio",
|
|
[1206] = "Newron Solutions",
|
|
[1207] = "Unitronics",
|
|
[1208] = "TRILUX GmbH & Co. KG",
|
|
[1209] = "Kollmorgen Steuerungstechnik GmbH",
|
|
[1210] = "Bosch Rexroth AG",
|
|
[1211] = "Alarko Carrier",
|
|
[1212] = "Verdigris Technologies"
|
|
}
|
|
--return vendor information
|
|
function vendor_lookup(vennum)
|
|
local vendorname = vendor_id[vennum] or "Unknown Vendor Number"
|
|
return string.format("%s (%d)", vendorname, vennum)
|
|
end
|
|
|
|
---
|
|
-- Function to lookup the length of the Field to be used for Vendor ID, Firmware
|
|
-- Object Name, Software Version, and Location. It will then return the Value
|
|
-- that is stored inside the packet for this information as a String Value.
|
|
-- The field is located in the 18th byte of the data field of a valid packet.
|
|
-- Depending on this field the information will be stored in field 20 + length
|
|
-- or in field 22 + length.
|
|
--
|
|
-- @param packet The packet that was received and is ready to be parsed
|
|
function field_size(packet)
|
|
-- read the Length field from the packet data byte 18
|
|
local offset
|
|
-- Verify the field from byte 18 to determine if the vendor number is one byte or two bytes?
|
|
local value = string.byte(packet, 18)
|
|
if ( value % 0x10 < 5 ) then
|
|
value = value % 0x10 - 1
|
|
offset = 19
|
|
else
|
|
value = string.byte(packet, 19) - 1
|
|
offset = 20
|
|
end
|
|
-- unpack a string of length <value>
|
|
local charset, info
|
|
charset, info, offset = string.unpack("Bc" .. tostring(value), packet, offset)
|
|
-- return information that was found in the packet
|
|
if charset == 0 then -- UTF-8
|
|
return info
|
|
elseif charset == 4 then -- UCS-2 big-endian
|
|
return unicode.transcode(info, unicode.utf16_dec, unicode.utf8_enc, true, nil)
|
|
else -- TODO: other encodings not supported by unicode.lua
|
|
return info
|
|
end
|
|
end
|
|
|
|
---
|
|
-- Function to set the nmap output for the host, if a valid BACNet packet
|
|
-- is received then the output will show that the port is open instead of
|
|
-- <code>open|filtered</code>
|
|
--
|
|
-- @param host Host that was passed in via nmap
|
|
-- @param port port that BACNet is running on (Default UDP/47808)
|
|
function set_nmap(host, port)
|
|
|
|
--set port Open
|
|
port.state = "open"
|
|
-- set version name to BACNet
|
|
port.version.name = "bacnet"
|
|
nmap.set_port_version(host, port)
|
|
nmap.set_port_state(host, port, "open")
|
|
|
|
end
|
|
|
|
--- Sends a query for Property Identifier id (a number) on socket
|
|
local function send_query(socket, id)
|
|
-- Wireshark dissection:
|
|
local query = string.pack(">BB I2 BBBBBBB I4 BB",
|
|
0x81, -- Type: BACnet/IP (Annex J)
|
|
0x0a, -- Function: Original-Unicast-NPDU
|
|
0x0011, -- BVLC-Length: 4 of 17 bytes
|
|
-- BACnet NPDU
|
|
0x01, -- Version: 0x01 (ASHRAE 135-1995)
|
|
0x04, -- Control (expecting reply)
|
|
-- BACnet APDU
|
|
0x00, -- APDU Type: Confirmed-REQ, PDU flags: 0x0
|
|
0x05, -- Max response segments unspecified, Max APDU size: 1476 octets
|
|
0x01, -- Invoke ID: 1
|
|
0x0c, -- Service Choice: readProperty
|
|
0x0c, -- Context-specific tag, number 0, Length Value Type 4
|
|
0x023fffff, -- Object Type: device; instance number 4194303
|
|
0x19, -- Context-specific tag, number 1, Length Value Type 1
|
|
id)
|
|
return socket:send(query)
|
|
end
|
|
|
|
local query_codes = {
|
|
firmware = 0x2c,
|
|
application = 0x0c,
|
|
model = 0x46,
|
|
object = 0x4d,
|
|
object_id = 0x4b,
|
|
description = 0x1c,
|
|
location = 0x3a,
|
|
vendor = 0x79,
|
|
vendor_id = 0x78
|
|
}
|
|
---
|
|
-- Function to send a query to the discovered BACNet devices. This will pull extra
|
|
-- information to help identify the device. Information such as firmware, application software
|
|
-- object name, description, and location parameters configured inside of the device.
|
|
--
|
|
-- @param socket The socket that was created in the action function
|
|
-- @param type Type is the type of packet to send, this can be firmware, application, object, description, or location
|
|
function standard_query(socket, type)
|
|
|
|
-- determine what type of packet to send
|
|
local query = query_codes[type]
|
|
assert(query) -- table lookup must not fail.
|
|
|
|
--try to pull the information
|
|
local status, result = send_query(socket, query)
|
|
if(status == false) then
|
|
stdnse.debug1("Socket error sending query: %s", result)
|
|
return nil
|
|
end
|
|
-- receive packet from response
|
|
local rcvstatus, response = socket:receive()
|
|
if(rcvstatus == false) then
|
|
stdnse.debug1("Socket error receiving: %s", response)
|
|
return nil
|
|
end
|
|
-- validate valid BACNet Packet
|
|
if( string.byte(response, 1) == 0x81 ) then
|
|
-- Lookup byte 7 (packet type)
|
|
local value = string.byte(response, 7)
|
|
-- verify that the response packet was not an error packet
|
|
if( value ~= 0x50) then
|
|
--collect information by looping thru the packet
|
|
return field_size(response)
|
|
-- if it was an error packet, set the string to error for later purposes
|
|
else
|
|
stdnse.debug1("Error receiving: BACNet Error")
|
|
return nil
|
|
end
|
|
-- else ERROR
|
|
else
|
|
stdnse.debug1("Error receiving Vendor ID: Invalid BACNet packet")
|
|
return nil
|
|
end
|
|
|
|
end
|
|
---
|
|
-- Function to send a query to the discovered BACNet devices. This function queries extra
|
|
-- information to help identify the device. Vendor ID query is sent with this
|
|
-- function and the Vendor ID number is parsed out of the packet.
|
|
--
|
|
-- @param socket The socket that was created in the action function
|
|
function vendornum_query(socket)
|
|
|
|
-- set the vendor query data for sending
|
|
local vendor_query = query_codes.vendor_id
|
|
assert(vendor_query)
|
|
|
|
--send the vendor information
|
|
local status, result = send_query(socket, vendor_query)
|
|
if(status == false) then
|
|
stdnse.debug1("Socket error sending vendor query: %s", result)
|
|
return nil
|
|
end
|
|
-- receive vendor information packet
|
|
local rcvstatus, response = socket:receive()
|
|
if(rcvstatus == false) then
|
|
stdnse.debug1("Socket error receiving vendor query: %s", response)
|
|
return nil
|
|
end
|
|
-- validate valid BACNet Packet
|
|
if( string.byte(response, 1) == 0x81 ) then
|
|
local value = string.byte(response, 7)
|
|
--if the vendor query resulted in an error
|
|
if( value ~= 0x50) then
|
|
-- read values for byte 18 in the packet data
|
|
-- this value determines if vendor number is 1 or 2 bytes
|
|
value = string.byte(response, 18)
|
|
else
|
|
stdnse.debug1("Error receiving Vendor ID: BACNet Error")
|
|
return nil
|
|
end
|
|
-- if value is 21 (byte 18)
|
|
if( value == 0x21 ) then
|
|
-- convert hex to decimal
|
|
local vendornum = string.byte(response, 19)
|
|
-- look up vendor name from table
|
|
return vendor_lookup(vendornum)
|
|
-- if value is 22 (byte 18)
|
|
elseif( value == 0x22 ) then
|
|
-- convert hex to decimal
|
|
local vendornum = string.unpack(">I2", response, 19)
|
|
-- look up vendor name from table
|
|
return vendor_lookup(vendornum)
|
|
else
|
|
-- set return value to an Error if byte 18 was not 21/22
|
|
stdnse.debug1("Error receiving Vendor ID: Invalid BACNet packet")
|
|
return nil
|
|
end
|
|
end
|
|
|
|
end
|
|
|
|
---
|
|
-- Action Function that is used to run the NSE. This function will send the initial query to the
|
|
-- host and port that were passed in via nmap. The initial response is parsed to determine if host
|
|
-- is a BACNet device. If it is then more actions are taken to gather extra information.
|
|
--
|
|
-- @param host Host that was scanned via nmap
|
|
-- @param port port that was scanned via nmap
|
|
action = function(host, port)
|
|
--set the first query data for sending
|
|
local orig_query = query_codes.object_id
|
|
assert(orig_query)
|
|
local to_return = nil
|
|
|
|
-- create new socket
|
|
local sock = nmap.new_socket()
|
|
-- Bind to port for niceness with BACNet this may need to be commented out if
|
|
-- scanning more than one host at a time, may fix some issues seen on Windows
|
|
--
|
|
local status, err = sock:bind(nil, port.number)
|
|
if(status == false) then
|
|
stdnse.debug1("Couldn't bind to %s/udp. Continuing anyway, results may vary", port.number)
|
|
end
|
|
-- connect to the remote host
|
|
local constatus, conerr = sock:connect(host, port)
|
|
if not constatus then
|
|
stdnse.debug1('Error establishing a UDP connection for %s - %s', host, conerr)
|
|
return nil
|
|
end
|
|
-- send the original query to see if it is a valid BACNet Device
|
|
local sendstatus, senderr = send_query(sock, orig_query)
|
|
if not sendstatus then
|
|
stdnse.debug1('Error sending BACNet request to %s:%d - %s', host.ip, port.number, senderr)
|
|
return nil
|
|
end
|
|
|
|
-- receive response
|
|
local rcvstatus, response = sock:receive()
|
|
if(rcvstatus == false) then
|
|
stdnse.debug1("Receive error: %s", response)
|
|
return nil
|
|
end
|
|
|
|
-- if the response starts with 0x81 then its BACNet
|
|
if( string.byte(response, 1) == 0x81 ) then
|
|
local value = string.byte(response, 7)
|
|
--if the first query resulted in an error
|
|
--
|
|
if( value == 0x50) then
|
|
-- set the nmap output for the port and version
|
|
set_nmap(host, port)
|
|
-- return that BACNet Error was received
|
|
to_return = "\nBACNet ADPU Type: Error (5) \n\t" .. stdnse.tohex(response)
|
|
--else pull the InstanceNumber and move onto the pulling more information
|
|
--
|
|
else
|
|
to_return = stdnse.output_table()
|
|
-- set the nmap output for the port and version
|
|
set_nmap(host, port)
|
|
|
|
-- Vendor Number to Name lookup
|
|
to_return["Vendor ID"] = vendornum_query(sock)
|
|
|
|
-- vendor name
|
|
to_return["Vendor Name"] = standard_query(sock, "vendor")
|
|
|
|
-- Instance Number (object number)
|
|
local instance = string.unpack(">I3", response, 20)
|
|
to_return["Object-identifier"] = instance
|
|
|
|
--Firmware Verson
|
|
to_return["Firmware"] = standard_query(sock, "firmware")
|
|
|
|
-- Application Software Version
|
|
to_return["Application Software"] = standard_query(sock, "application")
|
|
|
|
-- Object Name
|
|
to_return["Object Name"] = standard_query(sock, "object")
|
|
|
|
-- Model Name
|
|
to_return["Model Name"] = standard_query(sock, "model")
|
|
|
|
-- Description
|
|
to_return["Description"] = standard_query(sock, "description")
|
|
|
|
-- Location
|
|
to_return["Location"] = standard_query(sock, "location")
|
|
|
|
end
|
|
else
|
|
-- return nothing, no BACNet was detected
|
|
-- close socket
|
|
sock:close()
|
|
return nil
|
|
end
|
|
-- close socket
|
|
sock:close()
|
|
-- return all information that was found
|
|
return to_return
|
|
|
|
end
|