Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

The Baseboard Management Controller (BMC) is a service processor attached to modern server platforms to manage servers regardless of the state of the OS. Typically, this is done with either IPMI or Redfish. Access to this is catastrophic, leading to persistence below the OS even.

CVE-2013-4786 is an authentication issue in the IPMI 2.0. An unauthenicated party that can reach UDP port 623 can request can auth response to brute force passwords offline. The issue is an HMAC-SHA keyed by the admin password is sent to the user. If weak, reused, factory-set, or just easy to crack, you can get the password.

They searched for publicly exposed instances of this vulnerability. Of the 36K instances of IPMI they found, they found that 6K had a blank username with a weak password, and 2.3K with named account + a weak password. They believe that a large amount of Supermicro BMC's could be brute-forced on moderen servers but they chose not to do this.

They found an exposed HPE iLO 4 login page with a ransom note, demanding BTC to leave. To fix this, upgrade, or block the port from the public internet. It's interesting how some of these bugs from hard to patch systems just never die.