AsherDLL/mrhOTshOT_Docker_pub

What it is

mrhOTshOT is a Docker Compose lab for OT/ICS detection engineering and purple-team work, by Asher Davila and Malav Vyas. It generates realistic OT traffic and process behaviour so you can test detection rules and keep pcaps for later replay. Nothing touches real hardware. The Triconex honeypot is vendored from Nozomi Networks (BSD 3-Clause).

How it works

Each emulated target has its own container IP and speaks one protocol. The page maps them as follows:

• Water: IEC-104 on 2404
• Power: IEC-61850 on 8102
• Gas: OPC-UA on 4840 and FINS on 9600
• Centrifuge: S7comm on 102
• HVAC: BACnet/IP on 47808/udp
• Boiler: Modbus on 5020
• District heating: Modbus TCP on 502
• Water utility: DNP3 on 20000
• Sensors: M-Bus on 5000
• Vehicle: CANopen over TCP on 20001
• Traffic signals: NTCIP over SNMP on 161/udp
• Safety system: TriStation on 1502/udp

Three subnets model a Purdue layout: IT 192.168.0.0/24, OT 192.168.1.0/24 and management 192.168.100.0/24. The multi-homed router NATs IT to OT, so attacks cross it as they would in a plant. The router is the vulnerable edge device, serving HTTP on 8080.

Scenarios are YAML files in final_things/iec104_water_tank/demo/scenarios/. A manifest names the protocol, target, argv and watch view. A new file is picked up by the dashboard with no Python or JavaScript changes, and frostygoop_steps.yaml is the worked example. An optional Chatbot tab can turn a threat report into a scenario. It stays off unless you add an API key to docker/agent.env, and keys are read from the environment only.

Preconditions / Affected

• Linux or macOS, x86_64 or arm64.
• Docker Engine 20.10 or newer with Compose v2. Tested on 28.5.1 and Compose v2.40.0.
• Python 3.8 or newer on the host, standard library only, for one HMI seeding script.
• 2 GB free RAM to run and 4 GB for the first build.
• About 4.5 GB of disk, of which Caldera is 2.3 GB.
• Network access for the first build only. The lab runs offline afterwards.
• Host ports 102, 161/udp, 502, 1502/udp, 1881, 2404, 4840, 5000, 5020, 8080, 8102, 8888, 8889, 9600, 20000, 20001 and 47808/udp must be free. The installer warns about conflicts.

What to do

git clone https://github.com/AsherDLL/mrhOTshOT_Docker_pub.git
cd mrhOTshOT_Docker_pub
./scripts/install.sh

Run ./scripts/preflight.sh first to check the host. After install, the dashboard is at http://127.0.0.1:8888, the FUXA HMI at http://localhost:1881/home and Caldera at http://localhost:8889. Both the dashboard and Caldera use root / root. Change the dashboard login with MRHOTSHOT_UI_USER and MRHOTSHOT_UI_PASS, or set MRHOTSHOT_UI_PASS_HASH to a sha256 digest, which takes precedence.

Pick an attack, press Launch, then open Visualize. Restore resets the plant. For detection, start the optional passive Suricata IDS:

make sensor-up
make sensor-logs

Other targets: make lab-up, make lab-ps, make console-up, make hmi-seed, make test, make lint.

Caveats

• docker/caldera/local.yml ships Caldera's stock defaults, including root:root and the ADMIN123 encryption key. Do not expose port 8889 to an untrusted network without changing them.
• The dashboard can run arbitrary scripted attacks, and the Caldera agent beacons to its own server inside the lab network. Run it only on a host you control.
• The safety-system service implements the Triconex TriStation protocol, the TRITON attack surface.
• make lab-down removes the FUXA volume and the seeded HMI view with it. Use make lab-stop to stop containers only.
• make clean removes the images.
• The page does not say how closely each scenario reproduces the real incident or which Suricata rules are included.