knowledge

Overview

IPMI (Intelligent Platform Management Interface) is a set of standardized specifications for hardware-based host management. It operates independently of the host’s BIOS, CPU, firmware, and OS — allowing administrators to manage, monitor, and recover systems even when they are powered off, unresponsive, or failing. IPMI runs over UDP/623 and is implemented by a Baseboard Management Controller (BMC). During penetration tests, IPMI is significant because default credentials are rarely changed, and IPMI 2.0 contains a critical authentication vulnerability that allows offline hash cracking of any valid BMC account.

Terminology

TermDefinition
IPMIIntelligent Platform Management Interface — hardware-based out-of-band management specification
BMCBaseboard Management Controller — micro-controller implementing IPMI; embedded ARM system running Linux, connected directly to motherboard
iDRACIntegrated Dell Remote Access Controller — Dell’s BMC implementation
iLOIntegrated Lights-Out — HP’s BMC implementation
DRACDell Remote Access Controller — older name for iDRAC
RAKPRemote Authenticated Key Exchange Protocol — authentication protocol in IPMI 2.0; contains a critical flaw
ICMBIntelligent Chassis Management Bus — allows communication between chassis
IPMBIntelligent Platform Management Bus — extends the BMC
Hashcat Mode 7300Mode for cracking IPMI 2.0 RAKP HMAC-SHA1 hashes
out-of-band managementManaging a device via a separate channel (BMC network port) independent of the OS

Core Concepts

What IPMI Does

IPMI provides management capabilities that work regardless of OS state:

ScenarioIPMI Capability
Before OS bootsModify BIOS settings, configure boot order
Host fully powered offPower on/off, configure hardware
OS unresponsive/crashedReboot, reinstall OS remotely
Normal operationsMonitor CPU/memory/temps, query hardware inventory, review event logs

IPMI requires:

  • Baseboard Management Controller (BMC) — micro-controller with its own power source
  • LAN connection — BMC has a dedicated network port
  • Battery or standby power — so it operates when the main system is off

Components

ComponentFunction
BMCCore IPMI component; micro-controller running embedded Linux
ICMBInterface for chassis-to-chassis communication
IPMBExtends BMC capabilities to additional components
IPMI MemoryStores system event log, repository data
Communications InterfacesLocal, serial, LAN, ICMB, PCI Management Bus

Common BMCs encountered in penetration tests:

  • HP iLO — HP servers
  • Dell iDRAC — Dell servers
  • Supermicro IPMI — Supermicro hardware

BMC access gives full control over the motherboard: monitor, reboot, power off, or reinstall the OS.

Default Credentials

Default passwords are almost never changed in enterprise environments:

BMCDefault UsernameDefault Password
Dell iDRACrootcalvin
HP iLOAdministrator8-character random string (numbers + uppercase letters)
Supermicro IPMIADMINADMIN

HP iLO uses a factory-generated password — an 8-character string of uppercase letters and digits. If the RAKP hash is retrieved, it can be brute-forced offline with Hashcat using mode 7300 against a mask covering all combinations of 8 uppercase letters and numbers.

IPMI 2.0 RAKP Authentication Vulnerability

IPMI 2.0 has a critical design flaw in the RAKP authentication protocol:

  1. During authentication, the server sends a salted SHA1 or MD5 hash of the user’s password to the client
  2. This hash can be captured by any attacker who sends a valid authentication request
  3. The hash can be cracked offline using a dictionary attack (Hashcat mode 7300)
  4. This works for any valid user account on the BMC — not just admin accounts

There is no direct fix — the flaw is in the protocol specification itself. Mitigations:

  • Use long, complex unique passwords on all BMC accounts
  • Network segmentation — restrict access to BMC management interfaces
  • Monitor for unusual RAKP authentication attempts

Passwords cracked from IPMI hashes are often reused across the entire system.

Footprinting IPMI

Scan UDP/623 with Nmap using the ipmi-version NSE script to confirm the IPMI service and firmware version.

Identify IPMI version and dump RAKP password hashes using the ipmi_version and ipmi_dumphashes auxiliary modules in MSFConsole.

Crack RAKP hashes offline with Hashcat (RAKP mode) or JohnTheRipper (RAKP format). No server access required — the hash is obtainable from any valid username due to the protocol-level RAKP flaw.

Many BMCs also expose:

  • Web-based management console (HTTP/HTTPS)
  • SSH or Telnet CLI access
  • These should also be tested for default credentials
  • Service Enumeration

References / Images