IPMI Hash Dump (CVE-2013-4786)

IPMI (Intelligent Platform Management Interface) is the protocol used by baseboard management controllers (BMCs: HP iLO, Dell iDRAC, Supermicro) to administer a server out of band: power it on or off, mount remote media or open a console, even while the machine is off. It listens on UDP port 623 and carries a design flaw in its 2.0 version (CVE-2013-4786) that lets anyone retrieve a user's password hash without authenticating.

Mechanism

The problem is in the RAKP handshake itself (IPMI 2.0's authentication protocol). During negotiation, and before the client proves it knows the password, the BMC returns a message that includes an HMAC hash computed over the user's password. An attacker only has to request that message for a valid (or guessed) username and walks away with an offline-crackable hash, with no attempt limit and without leaving a failed login.

The Metasploit module automates it: it enumerates users and collects each one's hash in hashcat format:

msf6 > use auxiliary/scanner/ipmi/ipmi_dumphashes
msf6 auxiliary(ipmi_dumphashes) > set RHOSTS <ip>
msf6 auxiliary(ipmi_dumphashes) > run

The result is cracked with hashcat in the RAKP-specific mode:

hashcat -m 7300 ipmi.hashes <rockyou.txt>

Requirements. You only need to reach the BMC's UDP 623; no prior credentials are required. The hit rate is high because many BMCs ship with default users and passwords (ADMIN:ADMIN, root:calvin on iDRAC), which you do not even have to crack.

How to detect it

Locate the service with a UDP scan and the version module:

sudo nmap -sU -p 623 <ip>
msf6 > use auxiliary/scanner/ipmi/ipmi_version

Defence. The flaw is protocol-level and has no real patch: you must isolate the management network (BMCs should never be reachable from the user network or the Internet), change every default credential and use long, random passwords so the hash, even if leaked, is infeasible to crack. Related to hash cracking and SNMP enumeration.