SYS WTP-1 / PROC NaOH DOSING / LINK MODBUS TCP

Dosing Station
WTP‑1

Water treatment plant, sodium hydroxide (NaOH) dosing loop. Controller reachable directly over the plant network, real Modbus TCP wire format.

OT‑001 · WATER‑TREATMENT‑MODBUS
CATEGORY: OT
Process & instrumentation

Dosing Loop

Schematic layout · not live telemetry
RAW WATER IN TREATED WATER OUT NaOH STORAGE TK‑101 DOSING PUMP P‑101 AT 101 CONCENTRATION SENSOR (ppm) XA 101 SAFETY INTERLOCK (process-side, not client-enforced)
ISA-style tags for orientation only. Register addresses, thresholds and the control logic are not published, discover them by talking to the endpoint.

Network Exposure

Plant floor to controller
Client
Engineering workstation
(or you)
Modbus TCP · MBAP header + function code · port 6000
Controller
WTP‑1 dosing PLC
Direct register writes, no confirmation step
Field
Pump · sensor · interlock
Target
TARGET_HOST:6000
Protocol
Modbus TCP
Authentication
NONE, BY DESIGN
Encryption
NONE
Field incident log
FEB 2021
OLDSMAR, FL
Operator watched the cursor move on its own. Lye (NaOH) setpoint changed remotely from 100 ppm to 11,100 ppm. Caught and reverted before it reached the water supply.
NOV 2023
UNITRONICS PLCS
"CyberAv3ngers" compromised internet-exposed water booster station controllers across the US and Israel. No meaningful access control in place.
Objective

Cause a sustained, dangerous dosing condition on the live endpoint. The flag is not access-controlled, it is inert data that only becomes meaningful once the plant has actually been in a hazardous state long enough to matter.

FORMAT: CTF{...} NO SOURCE, NO BINARY, NO REGISTER MAP PROVIDED ANY MODBUS TCP CLIENT WORKS